Cisco – Pass traffic from remote access to site to site tunnel

If your ASA supports multiple context you ca try that. This means you will virtualize your ASA. You can have some clients in a context and other in other context.

The problem you are seeing is normal behavior. When you use object groups to define the tunnel traffic, the ACL gets expanded to a regular ACL with multiple entries. For example, this ACL

access-list outside_cryptomap extended permit ip 192.168.11.0 255.255.255.0 object-group DM_INLINE_NETWORK_1  

becomes

access-list outside_cryptomap extended permit ip 192.168.11.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list outside_cryptomap extended permit ip 192.168.11.0 255.255.255.0 192.168.50.0 255.255.255.0

Each line in the ACL creates a Securty Association (SA) for the VPN.

Because you are using dynamic VPNs, the SA doesn’t get created until the remote router sees traffic that matches the ACL entry. You apparently have devices on the 192.168.0.0 network that are talking to the 192.168.11.0 network, and this creates the SA for that entry.

But you don’t have any devices on the 192.168.50.0 network talking to 192.168.11.0, so the SA never gets built. With no SA, you can’t send traffic from 192.168.11.0 to 192.168.50 0. Once you ping from 192.168.50.0 to 192.168.11.0, the SA is created and you can send traffic in either direction.

To make this work the way you want, you have three choices:

1. Go back to static VPNs. The SAs are always up.
2. Find some way to generate traffic on the 192.168.50.0 network. Anything will do.
3. Readdress your networks so that you have one ACL entry that covers both networks at the remote end. You will have only one SA, which will be created as soon as traffic flows.