Issues sending traffic to a device located remotely from the VPN termination device.  The goal is to have a PC log in via AnyConnect to a firewall with a site to site VPN tunnel to reach the remote server.  The remote server can send traffic across the VPN tunnel to the local firewall which is acting as the VPN concentrator.  However, the PC is unable to send traffic to the remote network.
Who is Participating?
Pete LongConnect With a Mentor Technical ConsultantCommented:
Your description is a little vague


Remote Client---->AnyConnect--->VPN-Device--->IPSEC-VPN--->Remote network

Remote client gets to VPN device (and presumably the network behind it,) but not the remote network?

You need to hairpin the AnyConnect remote subnet onto the site to site VPN Crypto ACL and also add it to the NAT rule for the site to site VPN. Then on the remote Network you need to add the RemoveVPN subnet to the Cryptomap there, and again onto its NAT exemption coming back.

This might sound difficult but it isn't, I'm assuming  the VPN devices are Cisco ASA, and they have a fairly modern OS on them? If so follow my example in the link below;

Cisco Firewall VPN “Hair Pinning” Note: Cisco refer to this as a “Spoke to Spoke VPN”
QlemoBatchelor and DeveloperCommented:
AFAIK AnyConnect is designed to allow client-to-site-access only, not reversed, as with most VPN client solutions. Even if it would allow access to the client, it does not provide site-2-site access, to get to the client's network.
mwaukiAuthor Commented:
thanks!  finally go it going....

much appreciated.....
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.