ASA VPN not connecting

[matthew2587]

I am new to configuring VPNs and have this topology.

Background: we just added site 3 and created the VPN connection and it is currently working.

site 3 ---VPN------- site 1------VPN----- site2

Site 1 can communicate with both site 2 and 3. However, site 2 cannot communicate with site 3 and vice-versa. I thought this would be a simple fix on an acl/nat rule, but I cannot seem to figure this out. I am happy to provide configurations to help.

edit: I should also include that I did a packet tracer on site 1 from the subnets of 2 to 3 and it showed that it was allowed.

[MHM Cisco World · Accepted solution]

it simple but need correct steps 
1- Site1 to Site2 VPN 
in Site1 
ACL permit LAN-Site1 to LAN-Site2
ACL permit LAN-Site3 to LAN-Site2
in Site2
mirror of above ACL 

route in site2 toward site1 for site3LAN

2-Site1 to Site3 
in Site1
ACL permit LAN-Site1 to LAN-Site3
ACL permit LAN-Site2 to LAN-Site3 
in Site3 
mirror of above ACL 

route in site3 toward site1 for site2LAN 

that it 
MHM

[matthew2587]

Are these ACEs going to be added to ACL that is matched by the crypto map?

[MHM Cisco World]

yes friend 

MHM

[matthew2587]

Thank you, I was applying the ACLs in the wrong spots.

[matthew2587]

Do you think you could help with one more connection issue?

[MHM Cisco World]

sure friend what is your issue 
MHM

[matthew2587]

Your solution worked and we have connectivity, but our remote-access VPN users do not. They get a 192.168.252.0/24 address, so I thought it would be easy and just to add that network to ACLs, cryptomap, etc. But, that does not seem to be working, so I was wondering if you had any ideas?

I should mention that the users have connectivity to site-2 but not site-3, I tried to mirror the config on site 2 (changing the networks to reflect site) but it does not work or I missed something.