(newbie Cisco here)

I have an IPSEC vpn site to site tunnel between two ASAs. I have a set of networks in each location protected by the VPN tunnel.

So far, so good.

I would like to also protect traffic originated by the remote ASA, because I have an authentication server on this side.


  • serverfault.com/questions/346557/… (pre-dates NE) – Ricky Beam May 29 '15 at 1:00
  • Can you clarify and add a specific question? Are you having routing issues? – Citizen May 29 '15 at 5:24
  • How can I protect traffic originated on the remote ASA? If I ping from the remote ASA (CLI) , I see it's using the External interface (internet) as source IP, but it's not going through the IPSEC tunnel. – Sergio Jun 2 '15 at 22:19
  • Not to be nit picky but protect and encrypt are two very different concepts. Nothing networked is truly protected (e.g. iCloud hack, Fed gov't breach, Iranian Nuclear Power Plant breach, Merkels cell phone tapped, etc.) Ultimately if you want to protect information, do not store or transmit it in electronic format. Again, I don't mean to sound nit picky but this is an important point. – Ronnie Royston Jun 16 '15 at 2:51
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 17:02

management-access Configure management access interface

In short, that's a the global configuration command to tell the system what interface is used for management (i.e. any traffic generated by the ASA itself.) Cisco's documentation fails to mention that, btw.

| improve this answer | |
  • I setup the Internal interface as management-access, but still the source IP is the External interface. – Sergio Jun 2 '15 at 22:20
  • I assume your aaa-server is defined on "(inside)"? – Ricky Beam Jun 3 '15 at 4:46
  • My aaa-server is in site A. This ASA is the IPSEC termination in Site B. I want to configure aaa in site B, authenticating against a Radius server residing in Site A. – Sergio Jun 4 '15 at 15:37

There was a missing NAT line in the config, so traffic wasn't properly protected.


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.