Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am connecting to a ASA5505 at from home to the head-office using L2TP VPN.

Head-office then connects to a other-office via a site-to-site IPSEC tunnel.

When in the head-office ( I can ping/access remote-office ( OK.

When connected remotely to head-office, I can ping/access head-office OK from the road-warrior laptop.

My problem is that when connected remotely from home to the head-office I cannot ping/access the other-office subnet

On the home laptop the L2TP VPN connection is set to route all traffic to the VPN connection using the HQ as the internet gateway I can confirm this works.

I cant do traceroute (I get timeouts) as my policy doesnt allow and not sure how to enable this properly on the ASA.

Any ideas what is wrong, config is below:

name othersite
interface Vlan1
 nameif inside
 security-level 100
 ip address
interface Vlan2
 nameif outside
 security-level 0
 ip address
same-security-traffic permit intra-interface
access-list inside_nat0_outbound extended permit ip othersite
access-list inside_nat0_outbound extended permit ip any
access-list outside_1_cryptomap extended permit ip othersite
access-list DefaultRAGroup_splitTunnelAcl_1 standard permit
access-list outside_in_acl extended permit icmp any any echo-reply
access-list outside_in_acl extended permit tcp any interface outside eq smtp
ip local pool VPNLAN mask
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1
nat (outside) 1
static (inside,outside) tcp interface smtp smtp netmask
access-group outside_in_acl in interface outside
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
 dns-server value
 vpn-tunnel-protocol l2tp-ipsec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl_1
tunnel-group DefaultRAGroup general-attributes
 address-pool VPNLAN
 default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
 no authentication chap
 authentication ms-chap-v2
tunnel-group type ipsec-l2l
tunnel-group ipsec-attributes
 pre-shared-key *****
share|improve this question

1 Answer 1

up vote 2 down vote accepted

Your split tunnel ACL should encompass the other site's IP addresses, since that traffic should be sent through the VPN by the client.

access-list DefaultRAGroup_splitTunnelAcl_1 standard permit

The config looks good, otherwise. If this doesn't help, then turn up logging on the ASA and see what comes up when you try to send the traffic through.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.