You will need to add the source/dest networks in the crypto maps, configure your split tunnelling (if your not tunnelling all networks), configure your nat exempt (outside,outside), and as john has mentioned same-security-traffic permit intra-interface.
You may need to put in an ACL as well if your not bypassing interface ACL¹s in your VPN config. SteveH -----Original Message----- From: John Kougoulos <[email protected]> Date: Monday, 1 September 2014 16:24 To: ryanL <[email protected]> Cc: "[email protected] NSP" <[email protected]> Subject: Re: [c-nsp] asa 5510, remote access vpn, resources across lan-to-lan Resent-From: Steve Housego <[email protected]> >Hi, > >it could be nat but this depends on your routing config. It could also be >that this command is required: >same-security-traffic permit intra-interface > >Regards, >John > > >On Mon, Sep 1, 2014 at 4:57 PM, ryanL <[email protected]> wrote: > >> hi, >> >> i'm hopefully going to find someone who's done this before, or who has >> better google-fu than me. asa is not my strong suit. >> >> i have users vpn'ing (ipsec) into one 5510, accessing various corp >> resources there. the vpn pool isn't routed - i just nat it to one of the >> various inside interfaces depending on which vlan they're trying to hit. >> works fine. >> >> that particular 5510 has a l-2-l ipsec to a different 5510, which also >>has >> its own inside resources. if i vpn into it directly, i can hit those >>inside >> resources no problem. >> >> the question is - how do i get the vpn users hitting the first 5510 to >> reach the resources behind the second 5510? >> >> i know i'm close, as i'm at least triggering the l-2-l tunnel to be >>setup >> when vpn'd into the first 5510 and trying to reach the second 5510's >> resources. i'm just missing some nat, or something... >> >> appreciated. >> >> ryan >> _______________________________________________ >> cisco-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/cisco-nsp >> archive at http://puck.nether.net/pipermail/cisco-nsp/ >> >_______________________________________________ >cisco-nsp mailing list [email protected] >https://puck.nether.net/mailman/listinfo/cisco-nsp >archive at http://puck.nether.net/pipermail/cisco-nsp/ [http://www.it-ps.com/wp-content/uploads/2013/12/itps-logo.png] "Helping Your ICT Budget Deliver to its Maximum Potential" Steve Housego Principal Consultant IT Professional Services Axwell House Waterside Drive Metrocentre East Business Park Gateshead Tyne & Wear NE11 9HU T. 0191 442 8300 F. 0191 442 8301 [email protected]<mailto:[email protected]> Check out our new website at www.it-ps.com <http://www.it-ps.com/> and see how we can help your IT budget deliver more for less. [http://itpswebhost01.it-ps.com/customer_images/itps/twitter]<http://twitter.com/#!/itpsltd> [http://itpswebhost01.it-ps.com/customer_images/itps/facebook] <http://www.facebook.com/pages/ITPS/180607505381380> [http://itpswebhost01.it-ps.com/customer_images/itps/linkedin] <http://uk.linkedin.com/in/itpsltd> Company No. 3930001<tel:3930001> registered in England VAT No. 734 1935 33<tel:734%201935%2033> _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
