Cisco ASA IPSec VPN - Is port forwarding needed?

I have a Cisco ASA 5525 which serves only to provide IPSec VPN services to an outside business client.  There is one tunnel and all traffic is allowed.  The external interface of the ASA has a private IP address on it.  We have a router connected to the ISP that NAT's it's public IP to the ASA's external interface.  So the firewall's external interface appears as this ISP public IP.

The client needs to access hardware devices on the ASA's internal interface (192.168.97.0/24).  These hardware devices listen on port 5015.  The client cannot connect to the devices using the 192.168.97.x addresses across the VPN tunnel.  Do I need to do some sort of port forwarding (NAT) from the external ISP address to the ASA's internal network?  Shouldn't the client be able to see the hardware devices on the ASA's internal interface and access them via their private IP addresses? (We can access their servers across the VPN going the other way even though they have 10.x.x.x addresses)

Hopefully I'm not making this sound more complicated than it is.  Please feel free to ask clarifying questions.

I really need to solve this problem ASAP so thanks in advance for your assistance!!
CipherUserAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Qlemo"Batchelor", Developer and EE Topic AdvisorCommented:
NAT and routing are set up correctly, otherwise traffic would not flow at all. At least if the tunnel is up, no matter which partner starts communication.
It looks like one or both of the firewall/VPN devices blocks traffic initiated by your business client.
For Windows clients with active Windows Firewall,  you'll need to allow the remote network addresses too.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Hardware Firewalls

From novice to tech pro — start learning today.