Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So with Cisco's, ASA 5505 at one end, 5510 at the other, a Site-to-Site VPN is configured. SiteA and SiteB. Now it get's complicated as their are VLANs both sides, several in fact, but this is working and tested (we have IP phone at site B connecting to a phone system in SiteA, which is on a seperate VLAN to the PCs, and a PC in SiteB can also access a server in SiteA so that VLAN is working as well, so the routing is correct).

But there seems to be an issue with traffic allowed over the tunnel, for example, I cannot ping either site from either site, SiteA cannot access file shares in SiteB, but SiteB can access file shares in SiteA, I can RDP from SiteB to SiteA but not the other way around.

Now each site has two WAN links, Outside-WAN1 and Outside-WAN2 at SiteA, Outside-WAN3 and Outside-WAN4 at SiteB. At the moment, the VPN from SiteB looks at WAN1 at SiteA, and SiteA looks at WAN3 at Site B. Of course there are also the Inside interfaces.

Where do I setup the firewalls rules to allow ICMP or RDP or whatever from my network objects SITEA-LOCAL and SITEB-LOCAL ? On the Inside interface in the Firewall settings, or on the WAN interface that the VPN establishes it's Tunnel to?

Where would I specify what is allowed inbound to SiteB on INSIDE interface, and what is allowed outbound to SITEA-LOCAL on the Outside-WAN3 interface etc?

Or could there be more I am missing? Any advice is appreciated!

share|improve this question
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.