Could the ASA 5505 do a site to site VPN and still have client connected through IPSec VPN ( any connect clients ) at the same time ? I am having issues with clients not able to access local network and loosing internet in their computers once they are connected to IPSec VPN. It might be a firewall issue that I don't have much experience in, but I mentioned the site to site because this issue occurred after we established a VPN site to site connection with our other location ( Using D-Link DSR-250 on the other site if that matters )

Thank you for the help

  • What network blocks are you using on both sides of the VPN? Is there overlap between the two networks?
    – stevieb
    Jun 1, 2016 at 14:03
  • 1
    Can you post a config and a diagram? I'd wager it's an addressing/NAT issue, but without more info, it's just a guess.
    – Ron Trunk
    Jun 1, 2016 at 14:52
  • Yes, it can do site-to-site and client connections (multiple groups of clients, even.) I've done this for decades. You really need to know what you're doing to setup any level of VPN on cisco gear.
    – Ricky
    Jun 1, 2016 at 18:52
  • Enable split tunneling to access local resources, Internet.
    – Tsukasa
    Nov 29, 2016 at 18:06
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 19:15

3 Answers 3


When doing a Site-to-Site VPN with split tunneling you must configure as follows:

  1. Create a tunnel group on the ASA using the public peer address of your remote site, assign charictaristics to the tunnel group (i.c L2L), then assign a PSK PSKs must match on both sides of tunnel*

    Tunnel-group X.X.X.X type ipsec-l2l
    Tunnel-group X.X.X.X ipsec-attributes
    Ikev1 Pre-shared key THISISTHEKEY
  2. Create a transform set

    crypto ipsec ikev1 tranform-set (what ever your crypto / hashing/ encryp)
  3. Create an ACL identifing traffic to go through the Tunnel also prevents from being NAT'd by ASA

    access-list (Name) Permit ip
  4. Then create a tunnel:

    crypto map (name) 1 match address (The ACL you just created)
    crypto map (Same name as above) 1 set peer (remote peer public IP)
    crypto map (Same name as above) 1 set ikev1 transform-set (what ever you created)
  5. Apply to interface

    crypto map (name) interface outside

Then you can dynamically PAT the (any,outside)


Yes, you can do both at the same time. Check your licensing as you may need the security plus license for a certain number of concurrent connections but for one S2S VPN and a handful of client connections you should be OK.

One thing you want to look up is split tunneling. If you want your clients to use their local internet connection while connected to the VPN, split tunneling needs to be enabled. I can't remember the exact command off the top of my head but google cisco asa split tunnel.

Other than those things, what also causes issues is not NATing correctly like someone previously mentioned.

You can use the packet tracer command in the CLI or packet tracer menu item in ASDM to help determine if traffic is being allowed in or out, if it's going through the VPN and is getting NATed like you want (or don't want) it to.


As mentioned split tunneling is required, to tunnel all networks, but local net use the following;

create standard acl:

access-list Local-NET standard permit host

via your group-policy:

split-tunnel-policy excludespecified
split-tunnel-network-list value Local-NET

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.