I have remote access to a Cisco 2821 Router with a security firmware license in California with an IPSec tunnel going to a site in New York. On the New York side, there is a RFC 1918 IP scheme of The LA side is On the router, there is a VPN which hands out IP's by this command:

ip local pool Pool-1*

The issue is that, when I (or any other client) connects to the VPN on a remote computer, they are given an IP address (as seen below) but are still not able to contact the network. They can still access the local network and the internet, but I'm not sure that access to the internet is going through the VPN. It may be going through their normal home connection.

IP Addresses

Attempted Solutions:

  • The first thing I did was look at the routing table. It had no routes for the subnet, so I added some. I added the same route as the network since they had access, however this did not work.
  • After that, I imagined I should have put an ACL in place to allow traffic. I edited the existing ACLs to no avail.

My question:
When all said and done, the IP address of the VPN clients is originating within the router and is all virtual. My question is to what interface would I apply an ACL as to allow traffic?

Other Notes:

  • I had a coworker VPN into it as well and he was not able to ping my address.
  • The actual IP schemes are far more complex, but for sanity's sake, I've made them nice and easy without VLSM.
  • When I (or another client) connect to the VPN, there is a dynamic CRYPTO MAP policy added with an ACL that allows all incoming traffic to the IP, but nothing showing what it's allowed to go to...

1 Answer 1


Obviously you aren't using a Cisco VPN client, as it monitors the route table and will remove your tampering immediately. Even if the routes stick, the ASA will ignore traffic that doesn't belong in the tunnel.

There are two possibilities at play here:

  • the ASA isn't configured to hairpin traffic
  • the ASA isn't configured to allow those networks through the tunnel

The first can be enabled via same-security-traffic permit inter-interface and same-security-traffic permit intra-interface.

The second requires changes to the VPN split-tunnel configuration, any ACLs restricting access, routes on other gateways to know where the vpn-pool lives, and finally ensure the site-to-site VPNs know about and allow that pool across their tunnel.

(The latter is why my ASA proxy's DHCP from the local LAN for clients. It essentially makes VPN clients look like nodes on the local LAN.)


With IOS, the crypto map defines what traffic goes in the tunnel(s). (match address clause) That info is provided to the IPSec client. (it creates a security-association (SA) for each rule of the ACL.)

(for the record, I don't use the old IPSec client engine anymore. I prefer the SSLVPN (webvpn) setup on both ASA and IOS -- the setup is nearly identical. ASA-IOS tunnels are still the old, complicated crypto map IPSec setup. IOS-IOS tunnels, I prefer Tunnel interfaces.)

  • I'm not editing the ASA config from within the VPN. I'm using SecureCRT for that. This is the VPN Client: i.gyazo.com/9616ba74e360dcdfa4fe853d6538ce68.png
    – Goodies
    Commented Jan 31, 2015 at 0:22
  • Also, I'm an idiot. This isn't an ASA. The admin changed the hostname to "ciscoasa" for some inexplicable reason, but it's really a 2821 router with a security firmware. I can't believe I didn't notice this sooner.
    – Goodies
    Commented Jan 31, 2015 at 0:23
  • Let me ask it more simply... If I have a list of IP's given to people that VPN into the router, what "interface" are they connected to?
    – Goodies
    Commented Jan 31, 2015 at 0:47
  • Depending on how it's setup, none or a virtual-template. IPSec applies "in transit". (the site-to-site could be Tunnel interfaces.)
    – Ricky
    Commented Jan 31, 2015 at 0:50
  • Say you have a group of clients connecting to the router via that VPN client software and you do not want them to access a certain IP address. How would you block that with an ACL? Atm, it appears that I can access any directly connected network.
    – Goodies
    Commented Jan 31, 2015 at 0:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.