Hi, To access the internet via Stick Model, we have to do U-Turning on the ASA. We can PAT all the traffic comming from the outside interface to the outside interface while going outside. The ASA would check route once the packets hits the ASA and then perfroms NAT based upon the routing. To do a U-Turning, you have to add the following commands: nat (outside) 1 192.168.2.0 255.255.255.0 (i.e. the source network from where the packet is coming and the subnet mask) You already have a global (outside) 1 interface so you need not to add any other command for the NAT. same-security-traffic permit intra-interface (This command will enable U-Turning on the Firewall as it is disabled by defualt). So here is the packet flow: The packet would hit the firewall and would get decrypted by the SAs created. The firewall will check the routing for the destination address and it will point towards the outside interface The firewall will now see that the packet is coming from outside and going to outside and now our nat (outside) 1 and global (outside) 1 will take effect. For SSH: You have to make the interface the management interface on which you want to do ssh. For e.g managemen-access inside Now enable ssh on the interface: ssh 192.168.2.0 255.255.255.0 inside      192.168.2.0 is the network from where you want to ssh and inside is the interaface to which you want to ssh NOT ABLE TO ACCESS THE INTERNAL LAN: There can be many reasons for that. 1. Please add the follwoing command to enable nat-transparency: cry isakmp nat-t If this doesnt work, go to the next point: 2. Please send me the output of following commands once you are connected:      2.1 sh cry isa sa      2.2 sh cry ipsec sa 3. Live logging of the time when you ping anything on the inside. Please try to ping the inside interface of the ASA i.e. 192.168.1.1 after connecting to make sure nothing is wrong on the internal lan. Make sure you add the command management-access inside before you ping. HTH Mitesh Message was edited by: Mitesh ... View more