When connected to my network via a Cisco VPN connection, I am unable to connect to any other network subnets. I can connect to my corporate subnet (192.168.1.x), but not to a remote office (192.168.2.x).
I have a Cisco ASA 5510 firewall that hands out 192.168.5.x addresses to VPN clients. Is this a matter of a static route that needs to be added or is this an ACL issue?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
The corresponding access list I have for split tunneling in my config is this:
access-list CEA_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
So, I added this:
access-list CEA_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
...connected to the VPN, attempted to ping anything on the .2.x subnet to no avail.
Okay, since its a VPN off the ASA, there is more to it.
The site to site access-list needs to also include the 192.168.5.0 to 192.168.2.0 subnet on this ASA. The remove end access-list will need to be updated to include 192.168.2.0 to 192.168.5.0. You also may need to use a NAT0 access-list on the outside for VPN to VPN traffic depending on your NAT-control policy.
Sure did. I will attach the config of the remote site, as well.
%ASA-6-302021: Teardown ICMP connection for faddr 192.168.5.28/768 gaddr 192.168.2.2/0 laddr 192.168.2.2/0 (jhathaway)
%ASA-6-302020: Built inbound ICMP connection for faddr 192.168.5.28/768 gaddr 192.168.2.2/0 laddr 192.168.2.2/0 (jhathaway)
%ASA-6-302021: Teardown ICMP connection for faddr 192.168.5.28/768 gaddr 192.168.2.2/0 laddr 192.168.2.2/0 (jhathaway)
%ASA-6-302020: Built inbound ICMP connection for faddr 192.168.5.28/768 gaddr 192.168.2.2/0 laddr 192.168.2.2/0 (jhathaway)
%ASA-6-302021: Teardown ICMP connection for faddr 192.168.5.28/768 gaddr 192.168.2.2/0 laddr 192.168.2.2/0 (jhathaway)
%ASA-6-302020: Built inbound ICMP connection for faddr 192.168.5.28/768 gaddr 192.168.2.2/0 laddr 192.168.2.2/0 (jhathaway)
%ASA-6-302021: Teardown ICMP connection for faddr 192.168.5.28/768 gaddr 192.168.2.2/0 laddr 192.168.2.2/0 (jhathaway)
The nat (outside) you just added? Nice...
Really not much to this so not sure why it's not working...see below:
http://www.cisco.com/en/US
Can you post a "show cry ipsec sa" from both ASA's.
Alright, the tunnel dropped because I removed the wrong command. I removed the nat (inside) 0 statement on the main site firewall, thinking I had applied it to the wrong interface.
I removed the nat (outside) 0 statement and reapplied on both firewalls, still nothing.
Here is the result of the show cry ipsec sa from the main site:
Result of the command: "show cry ipsec sa"
interface: Outside
Crypto map tag: Outside_dyn_map, seq num: 20, local addr: 75.144.134.114
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.5.27/255.255.255.
current_peer: 209.6.174.244, username: nstandish
dynamic allocated peer ip: 192.168.5.27
#pkts encaps: 44379, #pkts encrypt: 44391, #pkts digest: 44391
#pkts decaps: 50328, #pkts decrypt: 50328, #pkts verify: 50328
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 44379, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 12, #pre-frag failures: 0, #fragments created: 24
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 24
#send errors: 0, #recv errors: 15
local crypto endpt.: 75.144.134.114/4500, remote crypto endpt.: 209.6.174.244/1099
path mtu 1500, ipsec overhead 66, media mtu 1500
current outbound spi: 0EA2DE6A
inbound esp sas:
spi: 0xE554A279 (3847529081)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 459, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 10581
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0x0EA2DE6A (245554794)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 459, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 10581
IV size: 8 bytes
replay detection support: Y
Crypto map tag: Outside_dyn_map, seq num: 20, local addr: 75.144.134.114
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.5.20/255.255.255.
current_peer: 66.30.186.113, username: bhevert
dynamic allocated peer ip: 192.168.5.20
#pkts encaps: 54343, #pkts encrypt: 54411, #pkts digest: 54411
#pkts decaps: 47518, #pkts decrypt: 47518, #pkts verify: 47518
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 54343, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 68, #pre-frag failures: 0, #fragments created: 136
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 136
#send errors: 0, #recv errors: 0
local crypto endpt.: 75.144.134.114/4500, remote crypto endpt.: 66.30.186.113/1117
path mtu 1500, ipsec overhead 66, media mtu 1500
current outbound spi: C0C1C42F
inbound esp sas:
spi: 0xB76949A2 (3077130658)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 444, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 22151
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0xC0C1C42F (3233924143)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 444, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 22151
IV size: 8 bytes
replay detection support: Y
Crypto map tag: Outside_map, seq num: 10, local addr: 75.144.134.114
access-list l2l_list permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0
remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0
current_peer: 67.62.134.115
#pkts encaps: 41023427, #pkts encrypt: 41023427, #pkts digest: 41023427
#pkts decaps: 36586431, #pkts decrypt: 36586431, #pkts verify: 36586431
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 41023427, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 2
#send errors: 0, #recv errors: 0
local crypto endpt.: 75.144.134.114, remote crypto endpt.: 67.62.134.115
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 25220048
inbound esp sas:
spi: 0x11CF477F (298796927)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 207, crypto-map: Outside_map
sa timing: remaining key lifetime (kB/sec): (4080057/10205)
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0x25220048 (622985288)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 207, crypto-map: Outside_map
sa timing: remaining key lifetime (kB/sec): (4034235/10205)
IV size: 8 bytes
replay detection support: Y
Crypto map tag: Outside_map, seq num: 10, local addr: 75.144.134.114
access-list l2l_list permit ip 192.168.5.0 255.255.255.0 192.168.2.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.5.0/255.255.255.0
remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0
current_peer: 67.62.134.115
#pkts encaps: 640, #pkts encrypt: 640, #pkts digest: 640
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 640, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 75.144.134.114, remote crypto endpt.: 67.62.134.115
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 6290EBC8
inbound esp sas:
spi: 0x24A0F22A (614527530)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 207, crypto-map: Outside_map
sa timing: remaining key lifetime (kB/sec): (4275000/21628)
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0x6290EBC8 (1653664712)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 207, crypto-map: Outside_map
sa timing: remaining key lifetime (kB/sec): (4274962/21628)
IV size: 8 bytes
replay detection support: Y
Crypto map tag: Outside_dyn_map, seq num: 20, local addr: 75.144.134.114
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.5.28/255.255.255.
current_peer: 71.233.179.11, username: jhathaway
dynamic allocated peer ip: 192.168.5.28
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 5, #pkts decrypt: 5, #pkts verify: 5
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 75.144.134.114/4500, remote crypto endpt.: 71.233.179.11/3193
path mtu 1500, ipsec overhead 66, media mtu 1500
current outbound spi: D69D9F8F
inbound esp sas:
spi: 0x32232C59 (841165913)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 482, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 28755
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0xD69D9F8F (3600654223)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 482, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 28755
IV size: 8 bytes
replay detection support: Y
Crypto map tag: Outside_dyn_map, seq num: 20, local addr: 75.144.134.114
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.5.25/255.255.255.
current_peer: 71.243.55.86, username: coneill
dynamic allocated peer ip: 192.168.5.25
#pkts encaps: 32327, #pkts encrypt: 32345, #pkts digest: 32345
#pkts decaps: 31203, #pkts decrypt: 31203, #pkts verify: 31203
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 32327, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 18, #pre-frag failures: 0, #fragments created: 36
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 36
#send errors: 0, #recv errors: 0
local crypto endpt.: 75.144.134.114/4500, remote crypto endpt.: 71.243.55.86/4442
path mtu 1500, ipsec overhead 66, media mtu 1500
current outbound spi: 97613F89
inbound esp sas:
spi: 0x617BFDC6 (1635515846)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 458, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 8586
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0x97613F89 (2539732873)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 458, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 8586
IV size: 8 bytes
replay detection support: Y
Crypto map tag: Outside_dyn_map, seq num: 20, local addr: 75.144.134.114
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.5.29/255.255.255.
current_peer: 76.120.2.95, username: lquilici
dynamic allocated peer ip: 192.168.5.29
#pkts encaps: 465, #pkts encrypt: 465, #pkts digest: 465
#pkts decaps: 793, #pkts decrypt: 793, #pkts verify: 793
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 465, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 75.144.134.114/4500, remote crypto endpt.: 76.120.2.95/2344
path mtu 1500, ipsec overhead 66, media mtu 1500
current outbound spi: D004F310
inbound esp sas:
spi: 0xAE114735 (2920367925)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 481, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 27993
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0xD004F310 (3489985296)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 481, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 27993
IV size: 8 bytes
replay detection support: Y
Crypto map tag: Outside_dyn_map, seq num: 20, local addr: 75.144.134.114
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.5.26/255.255.255.
current_peer: 76.179.71.136, username: bhopkins
dynamic allocated peer ip: 192.168.5.26
#pkts encaps: 7572, #pkts encrypt: 7593, #pkts digest: 7593
#pkts decaps: 8968, #pkts decrypt: 8968, #pkts verify: 8968
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 7572, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 21, #pre-frag failures: 0, #fragments created: 42
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 42
#send errors: 0, #recv errors: 0
local crypto endpt.: 75.144.134.114/4500, remote crypto endpt.: 76.179.71.136/2474
path mtu 1500, ipsec overhead 66, media mtu 1500
current outbound spi: 74127397
inbound esp sas:
spi: 0xD7F2DE8A (3623018122)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 457, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 26599
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0x74127397 (1947366295)
transform: esp-3des esp-sha-hmac none
in use settings ={RA, Tunnel, NAT-T-Encaps, }
slot: 0, conn_id: 457, crypto-map: Outside_dyn_map
sa timing: remaining key lifetime (sec): 26599
IV size: 8 bytes
replay detection support: Y
From the remote site:
Result of the command: "sh cry ipsec sa"
interface: outside
Crypto map tag: DC2BOS, seq num: 1, local addr: 67.62.134.115
access-list l2l_list permit ip 192.168.2.0 255.255.255.0 192.168.5.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0
remote ident (addr/mask/prot/port): (192.168.5.0/255.255.255.0
current_peer: 75.144.134.114
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 655, #pkts decrypt: 655, #pkts verify: 655
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 67.62.134.115, remote crypto endpt.: 75.144.134.114
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 24A0F22A
inbound esp sas:
spi: 0x6290EBC8 (1653664712)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 4096, crypto-map: DC2BOS
sa timing: remaining key lifetime (kB/sec): (3824961/21541)
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0x24A0F22A (614527530)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 4096, crypto-map: DC2BOS
sa timing: remaining key lifetime (kB/sec): (3825000/21541)
IV size: 8 bytes
replay detection support: Y
Crypto map tag: DC2BOS, seq num: 1, local addr: 67.62.134.115
access-list l2l_list permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0
remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0
current_peer: 75.144.134.114
#pkts encaps: 36593992, #pkts encrypt: 36593992, #pkts digest: 36593992
#pkts decaps: 41027877, #pkts decrypt: 41027877, #pkts verify: 41027877
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 36593992, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 67.62.134.115, remote crypto endpt.: 75.144.134.114
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: 11CF477F
inbound esp sas:
spi: 0x25220048 (622985288)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 4096, crypto-map: DC2BOS
sa timing: remaining key lifetime (kB/sec): (3583201/10121)
IV size: 8 bytes
replay detection support: Y
outbound esp sas:
spi: 0x11CF477F (298796927)
transform: esp-3des esp-sha-hmac none
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 4096, crypto-map: DC2BOS
sa timing: remaining key lifetime (kB/sec): (3629068/10121)
IV size: 8 bytes
replay detection support: Y
Well, having pulled my Joe Maddon baseball card out (from last night, in case your a baseball fan), and already dropped the tunnel on them once, I think I'll wait until this evening to reboot the remote firewall.
I will advise on how that works out after the reboot.
And before I forget, I'm very appreciative of all of your help so far! Thank you.
Business Accounts
Answer for Membership
by: JFrederick29Posted on 2009-05-18 at 08:47:54ID: 24413203
If you are split tunneling, it may simply be a matter of adding 192.168.2.0/24 to the split tunnel access-list.