Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following situation:

Client subnet( /24) ----> Router ----> Internet ----> 
           ASA( /24) ----> 
       ( /24)Gateway ----> ( /8)Many subnets 

I need to logically connect the client subnet to the "many subnets". On the left side I have a Cisco 2901 and on the other an ASA. I built an IPsec connection between the router and the ASA. The IPsec connection itself works but I cannot access any address behind the gateway. The local network of the IPsec connection is the network.

The ASA doesn't get it that it has to route the traffic through the gateway ( I already set a default route on the inside interface to but that doesn't work...

How can I tell the ASA that it has to route all traffic through the gateway?

share|improve this question
up vote 1 down vote accepted

You need to add the "many subnets" to your protected network.

Router should have as his protected network. ASA should have the "many subnets" as his protected networks.

Also, unless you checked the "Do not translate VPN traffic", you will need to add a NAT rule in the ASA ( in order to let the VPN traffic traverse the ASA.

Your NAT rule should be a static one if you need both sides to initiate a connection.

share|improve this answer
The problem is that the traffic don't get routed to the gateway. I see the incoming traffic in the logs on the ASA. The traffic just don't get routed to the gateway. – FrediWeber Mar 28 '13 at 7:50
Does the ASA have an interface with an IP within the subnet? – Alex Mar 28 '13 at 16:40
Thank you. The NAT rule solved the problem on the ASA. – FrediWeber Mar 30 '13 at 10:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.