Site to Site VPN and Point to Point routing help . 500 pts to the winner

Posted on 2007-07-25
Last Modified: 2011-09-20
Hello, I have an ASA5510 for a firewall, and it also terminates a site to site vpn and client vpns.  The corporate office also has a point to point with another office via a Cisco 2800 series router.  At the corporate office all end user devices are given the point to point router IP address as the D/G. That router has a route in it that pushes traffic over to the ASA5510 if it is not destined for the other side of the point to point.  The info is as follows:

Coroprate office ASA5510 IP address /24 subnet
Corporate office C2800 router (point to point with office 2) internal IP
Office 2  (other side of point to point) - C2800 series router internal IP
Office 3 (other side of site to site vpn) ASA5505 - Internal network of /24

Right now, Office 3 can ping to the corporate office accross the VPN tunnel.  It cannot ping to office 2.  I.e., I can not ping from

Office 2 can ping corporate via the point to point T1, but it cannot ping to Office 3 by going through corporate and then the site to site.  

Lastly, remote access clients who VPN into the ASA5510 can access corporate resources, but they cannot access the office at the other end of the site to site or the point to point T1.

My questions are as follows:

1.  How can I make it so that Office 3 can communicate to office 2.  The path would be through the vpn tunnel to the point to point ethernet interface at corporate, then through the T1 to the remote office.

2.  How can I make it so that remote users can VPN into Corporate but still be able to access the office accross the point to point T1?  

I believe I just need a couple of route statements on my firewall and possibly something to bypass nat?  Help would be greatly appreciated.
Question by:ddftech
    LVL 3

    Expert Comment

    by:Adrien de Croy
    Looks like the problem would be in the ASA5510.

    If it terminates the VPN connections for the remote offices and the remote workers, and is providing access for these remote offices to the corporate office but not each other, then it must be some setting in the device which is prohibiting different remote nodes from communicating with each other.

    This is commonly done for security reasons - I'm not familiar with that device, but it may be possible to turn on a setting which would allow it to forward packets received on one tunnel back out another one.
    LVL 79

    Accepted Solution

    ASA needs a route statement like this:
     route inside

    And the VPN tunnel information needs to have in the ipsec defined acls. Site 3 vpn tunnel definition acls also need to have site 2's subnet.
     access-list nat_zero permit ip
     access-list nat_zero permit ip
    access-list tunnel_to_site3 permit ip192.168.0.0
    access-list tunnel_to_site3 permit ip192.168.1.0
    crypto map MYMAP 10 match address tunnel_to_site3

    Site 3's configuration would be mirror image.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    Suggested Solutions

    Some of you may have heard that SonicWALL has finally released an app for iOS devices giving us long awaited connectivity for our iPhone's, iPod's, and iPad's. This guide is just a quick rundown on how to get up and running quickly using the app. …
    Shadow IT is coming out of the shadows as more businesses are choosing cloud-based applications. It is now a multi-cloud world for most organizations. Simultaneously, most businesses have yet to consolidate with one cloud provider or define an offic…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now