Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I’ve setup VPN on our ASA5510 (8.0.(3)), everything seems to work fine except I can’t remotely get to our satellite offices or any routers/switches on the 10.76.x.x network…seems like it would be a routing issue or an ACL not configured to allow the VPN DHCP group to talk to the 10.76 network, but I’m not seeing it so far.

VPN DHCP scope is – when on VPN I can successfully ping our internal network ( and access everything on the network needed, but if I try to ping 10.76.x.x (10.76.0.x or our switches/routers/etc, for our satellite offices) or remote to them, I can’t get through. It simply can’t seem to see the 10.76.x.x networks….

I have an exempt statement on the ASA on the outside, to inbound, and one just like it for I also have an inside exempt statement in reverse, inside, to, and one just like it for

On the firewall I have an ACL on the inside from to permit IP, seems to be working and I see the hit count going up. I have a statement just like it for but I never it see it being referenced, sitting at 0 hits.

On the firewall I have an ACL on the outside from outside saying to permit IP, works and I see the hit count going up, but have a similar statement for and same as above, no hits.

I have the default tunneled route set to our inside interface.

I probably have too much allowed currently, or at least a line or two that is unnecessary but if I could get it work then I could step it back down to tighten it up… I’ve tried looking at the logs as well. I’ve logged onto kiwi syslog, monitored it while I attempt to ping 10.76.x.x from a laptop connected to VPN. I never see a deny for it, nor do I even see the 10.76 address anywhere in the log when I do a search. I see the IP of the laptop from where it is talking with our domain controller, where it does it’s initializations and such, but nothing referencing the 10.76 network. I would expect to see an entry somewhere as to where it’s being stopped…but that makes me think it’s not even making it to that point.

I’m sure like usual it’s something small I’m overlooking, but having a fresh set of eyes (or many fresh sets of eyes!) on it might be what it needs. I appreciate the help, thanks!

share|improve this question
If your remote office tunnels terminate on the same firewall, then under Device Setup, Interfaces, you need to check "Enable traffic between two or more hosts connected to the same interface". Another thing to look at is the routing table on the laptop when it's connected to that VPN. – Max Alginin May 25 '11 at 17:17
This fixed my issue, how do i mark this as the correct answer? Thanks! – Don May 27 '11 at 15:47
up vote 0 down vote accepted

You will need the VPNs to the remote sites to be configured to carry traffic to your mobile VPN range, and the mobile VPN to carry the remote site ranges too: ( <==> on both the laptop-cisco and cisco-remote-sites.

If you don't have that on the laptop-cisco VPN then the traffic for the remote sites will never reach the cisco (use "route print" at the command line to find out on Windows), and if you don't have that on the cisco-remote-sites VPNs then the traffic will stop at the cisco, and the remote sites wont know how to send traffic to your laptop because their tunnel policies wont know where is.

If another device does the VPNs to remote sites, it may be a simple routing issue - all devices need to route the networks both ways, not just out to the remote sites, but also back again. It sounds more likely to be the tunnel policies though.

share|improve this answer
Ahh, "Enable traffic between two or more hosts connected to the same interface" seemed to work, i can now ping the other side! Thank you both for your help! Are there any security concerns with having that checked? I guess that's just how it has to be setup when you have one ASA versus if you were doing site to site? Thanks again! – Don May 25 '11 at 20:30
Sorry, I'm not familiar with that option to say. I'd test if it means one laptop connected by VPN can talk to another connected by VPN, you might not want that happening, for example. – TessellatingHeckler May 25 '11 at 22:21
The option is safe and exists only to maintain the same default behavior as older versions of PIX, where it was absolutely impossible. – Max Alginin May 26 '11 at 3:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.