Getting the ASA5505 VPN to work behind a 2921 router

[Y W]

Hi all,

I am trying to create a VPN access by using ASA5505 and using VPN client

We have the ISP which give us 4 public ip addresses.

The ISP dmarc is connected to a C2921, which use the first public ip address on its outside interface.

i did a static nat with a second ip address to the ASA5505's internal address.

Please see the drawing attached.

The ASA5505 have been configured and proven to work if attached directly to the dmarc with a outside link and internal network with inside link

My problem right now is that when reconfigured into the diagrammed scenario, i made it able to connect and VPN client shows connected, but I am unable to ping either 192.168.1.2 or the server/host on the inside network.

The 2921 must be attached to the dmarc, and the ASA5505 must remain attached to the switch.

any suggestions? Thanks in advance

[Cisco Freak]

Hey, 

Do you have the NAT exemption for VPN client range(172.16.1.10-20) in your 2921 router? Are you running split tunnel?

CF

[Y W]

hi Cisco Freak,

this is where my network knowledge becomes limited, but I always thought that when you VPN in, the device you are using brokers the connection to the inside network. Can you point me to the right direction of why is a NAT exempt needs to be implemented on the 2921 router?

Also yes split tunnel is enabled, again with my limitation on knowledge Split tunnel just send the traffic for the 192.168.1.x traffic via the VPN connection and all others via the normal local gateway. How does it influence the connection on this scenerio?

Many thanks.