Showing results for 
Search instead for 
Did you mean: 

cannot access asdm over L2L VPN


We have L2L VPN between 2 sites working without any issue, except we are not able to access ssh/asdm of remote ASA (DR) from local LAN of local ASA (HQ).

We have followed this cisco document

we have

1. route-lookup for No-NAT subnets (local and remote ASA)

2. management-access inside ( remote ASA)

3. SSH/HTTP allowed on inside interface (remote ASA)

4. SSH/HTTP allowed on outside interface (remote ASA)

5. Routing is okay

6. We can see packet leaves local ASA and hits remote ASA (ASDM monitoring).


Your input is highly appreciated and look forward for positive response.

Thanks & Regards





10 Replies 10

Marius Gunnerud
VIP Advisor VIP Advisor
VIP Advisor

Have you included the ASA inside interface that you are trying to connect to in the crypto ACL?  Would help if you posted the full running configuration for both sides of the tunnel.  Remember to remove any public IPs, usernames, passwords, and hostname of the devices.

Please remember to select a correct answer and rate helpful posts

Yes included, I will post the desired config soon

Thank You

Interesting one; can you ping it at least?
I would run :capture type asp-drop match ip host ...".

I would also double check NAT config on both sides.

Please check attached desired config

This is just partial configuration please provide a full configuration of the two ASAs (remember to remove public IPs, usernames, passwords)


Or at least provide us with all Crypto configuration, NAT configuration, routing configuration, and information on which IP you are trying to access the ASA from.

Please remember to select a correct answer and rate helpful posts

Ping is blocked in whole path (Cisco ASA, CheckPoint Firewall and Perimeter router).

I have not done this capture type asp-drop match ip host ...".

Config is good - still capture asp-drop can tell you if something "unexpected" takes place.
You can also run a capture based on an ACL place on the inside interface and see how 'what you can see'

After capturing packets and packet tracer, i found that the traffic was hitting different natting which did not have route lookup command, so after rectifying natting,  asdm was accessible.

thanks for your input.

This is why I keep asking for the full running configuration of the ASA as there might be some configuration that people think is not relevant but it actually is.

Glad you found the solution though

Please remember to select a correct answer and rate helpful posts

Is this by any chance an ASA5506 configured with BVI?

Please remember to select a correct answer and rate helpful posts
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: