I have the network topology in the following link please kindly refer it : http://www.gigapac.com/wp-content/uploads/2012/03/topology.png

  1. A site to site IPSec VPN is running between the two Cisco routers.
  2. The ASA firewall has two interfaces e0/0 (outside) and e0/1 (inside) and is currently configured to act as the default gateway for the PCs in the LAN.
  3. I have also added a route in ASA which routes via (inside) interface.
  4. The PC having IP address cannot make RDP connection to But when I set a static route in the PC and route via then the RDP session works.
  5. I have also enabled the following command :

    same-security-traffic permit intra-interface

But still no luck. Do I need to do "no nat-control" or do some static translations?

  • Can you run a packet-tracer simulating the attempt at an RDP connection? What device is handling the routing to the .51 network? – Shane Madden Mar 31 '12 at 18:33

The ASA is only seeing half of the traffic flow.

A SYN packet from the PC on will be sent to the ASA, which will track it and then forward it to the route on This router will send the SYN over to the router on, and on to the machine on

A SYN+ACK packet will be sent back to the router on, across the IPSec tunnel to the router on, and to the PC without going via the ASA. When the ACK packet is sent from the client, the ASA will drop the packet as it hasn't seen the SYN+ACK back from the machine on

To fix this, the ASA needs to see traffic in both directions. There are many solutions - one of them could be to move Fa0 of the router to the outside interface of the ASA.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.