I've set up a standard site to site VPN between 2 ASA 5505s (using the wizard in ASDM) and have the VPN working fine for traffic between Site A and Site B on the directly connected LANs.

But this VPN is actually to be used for data originating on LAN subnets that are one hop away from the directly connected LANs. So actually there is another router connected to each ASA (LAN side) that then route to two completely different LAN ranges, where the clients and servers reside.

At the moment, any traffic that gets to the ASA that has not originated from the directly connected LAN gets sent straight to the default gateway, and not through the VPN.

I've tried adding the additional subnets to the "Protected Networks" on the VPN, but that has no effect. I have also tried adding a static route to each ASA trying to point the traffic to the other side, but again this hasn't worked.

Here is the config for one of the sites. This works for traffic to/from the 192.168.144.x subnets perfectly. What I need is to be able to route traffic from to for example.

ASA Version 8.0(3)  
hostname Site1  
enable password **** encrypted  
name Site2  
interface Vlan1  
nameif inside  
security-level 100  
ip address  
interface Vlan2  
nameif outside  
security-level 0  
ip address (this is a private WAN circuit)  
interface Ethernet0/0  
switchport access vlan 2  
interface Ethernet0/1  
interface Ethernet0/2  
interface Ethernet0/3  
interface Ethernet0/4  
interface Ethernet0/5  
interface Ethernet0/6  
interface Ethernet0/7  
passwd ****** encrypted  
ftp mode passive  
access-list inside_access_in extended permit ip any any  
access-list outside_access_in extended permit icmp any any echo-reply  
access-list outside_1_cryptomap extended permit ip 
access-list inside_nat0_outbound extended permit ip Site2  
pager lines 24  
logging enable  
logging asdm informational  
mtu inside 1500  
mtu outside 1500  
icmp unreachable rate-limit 1 burst-size 1  
asdm image disk0:/asdm-603.bin  
no asdm history enable  
arp timeout 14400  
global (outside) 1 interface  
nat (inside) 0 access-list inside_nat0_outbound  
nat (inside) 1  
access-group inside_access_in in interface inside  
access-group outside_access_in in interface outside  
route outside 1  
timeout xlate 3:00:00  
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  
timeout uauth 0:05:00 absolute  
dynamic-access-policy-record DfltAccessPolicy  
aaa authentication ssh console LOCAL  
http server enable  
http outside  
http inside  
no snmp-server location  
no snmp-server contact  
snmp-server enable traps snmp authentication linkup linkdown coldstart  
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac  
crypto map outside_map 1 match address outside_1_cryptomap  
crypto map outside_map 1 set pfs  
crypto map outside_map 1 set peer  
crypto map outside_map 1 set transform-set ESP-3DES-SHA  
crypto map outside_map interface outside  
crypto isakmp enable outside  
crypto isakmp policy 10  
authentication pre-share  
encryption 3des  
hash sha  
group 2  
lifetime 86400  
no crypto isakmp nat-traversal  
telnet timeout 5  
ssh outside  
ssh timeout 5  
console timeout 0  
management-access inside  

threat-detection basic-threat  
threat-detection statistics port  
threat-detection statistics protocol  
threat-detection statistics access-list  
group-policy DfltGrpPolicy attributes  
vpn-idle-timeout none  
username enadmin password ***** encrypted privilege 15  
tunnel-group type ipsec-l2l  
tunnel-group ipsec-attributes  
pre-shared-key *  
prompt hostname context 

The crypto map access-list (outside_1_cryptomap) is only going to match direct subnet traffic. You probably need to add more entries to this access-list to match the other subnets that should traverse the tunnel. If you want to support any network on one side to any network on the other side, you might find it easier to declare some network object-groups and then make your access-list read something like:

object-group site1_nets
object-group site2_nets
access-list outside_1_cryptomap extended permit ip object-group site1_nets object-group site2_nets

The nat 0 access-list (inside_nat0_outbound) is also not matching traffic from the other subnets, so the ASA will want to translate the IP address to your outside WAN address.

access-list inside_nat0_outbound extended permit ip object-group site1_nets object-group site2_nets

I'm not 100% positive this second change is necesssary; try the first and test to see if you need it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.