VPN user is not able to access Site to site Host behind another Firewall

[Amardeep Kumar]

Hi ,

We have two cisco ASA are connect Via P2P tunnel fiber link provided by ISP.

ASA - A is main Firewall where VPN user Connects.

ASA - B where our Hosts are placed and VPN users wants to access these hosts.

We are not able to access those host. Please suggest.

Thanks

Amardeep Rana

[Rahul Govindan]

Few things you can check:

1) Right encryption domains in the crypto ACL - You need to have the VPN subnet as local proxy network on ASA A and as a remote proxy network on ASA B. 

2) Add the remote subnet in the VPN split tunnel

3) Allow same-security-traffic permit intra-interface

4) Check Identity nat rules (nat exemption) on ASA A for vpn subnet between outside to outside interface

5) Check Identity nat rules (nat exemption) on ASA B for von subnet between inside and outside interface.

[Amardeep Kumar]

1. VPN user Connects to ASA A and able to access hosts Behind ASA A. 

2. Remote Subnet You mean , Subnet of ASA B ?

3.Already Done.

Thanks

Amardeep 

[Rahul Govindan]

Yes, your split tunnel should include subnet behind ASA B (subnet where hosts are located). If not, this traffic will not even make it through the Remote access tunnel 

[Amardeep Kumar]

I checked , It is already added in split tunnel.

[Amardeep Kumar]

Just want to clear 

Both ASA are not connected through Site to Site Tunnel. we  have taken a P2P connection from ISP. 

Thanks

Amardeep 

[Rahul Govindan]

Ah ok, then except point#1 everything should be valid. 

[Amardeep Kumar]

Please give me more details about Point 4 and 5 . 

nat (inside,outside) source static VPN_Pool VPN_Pool destination static REMOTE-SITES REMOTE-SITES no-proxy-arp route-lookup

nat (inside,outside) source static REMOTE-SITES REMOTE-SITES destination static VPN_Pool VPN_Pool no-proxy-arp route-lookup

[Rahul Govindan]

If your WAN link is outside, your first nat rule should be (outside,outside). VPN users are logically located on the outside interface with respect to the ASA.

Second NAT rule looks correct.

[Amardeep Kumar]

Tried All suggestion .. Still not able to access host behind ASA B. 

[Rahul Govindan]

I would apply packet captures on the ASA A WAN and ASA B LAN and WAN interfaces to see where the traffic makes it through. The packet capture config example is here:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118097-configure-asa-00.html