You probably don't have a matching SPD on the remote site. That's my guess.
If the user is coming in and having an IP address assigned, then that IP address has to be in the protected network on both ends. Did you remember to put the set of assigned IP addresses in the SPD on the remote site that the user is trying to get to? Look at the IPsec selectors on the tunnel at the remote site and make sure that the source & destinations you're using (the assigned IP and the remote network) are covered. In addition, the ASA has to be smart enough to decrypt/encrypt on the same packet. That used to be a strange feature, but I can't imagine that the ASA won't do it (the PIX used to, anyway). However, it's possible that you need to kick on some feature to allow that in the 'anything we didn't used to do, you now have to explicitly ask for like cef even though everyone wants it' theory. jms Aaron R wrote: > Hey guys, > > This is a quick one. Has anyone had problems with VPN remote access clients > accessing resources over a LAN to LAN or site to site VPN before? Can anyone > illustrate what considerations need to be made typically for this kind of > setup? Below is my situation. > > 1. Client connects to our network via Cisco VPN Client to ASA. > 2. Client attempts to access resources at a remote site via a Site-to-Site > Tunnel configured on the same ASA. > 3. I can see outbound connection is made but I see nothing after this point > (I am using syslogs here) > 4. I see no deny or drops after this point but the connection is not made > back to the existing VPN client. > > > Cheers, > > Aaron. > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 [EMAIL PROTECTED] http://www.opus1.com/jms _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
