Firewall – Migrating from ASA 5520 to 5525x

In order for the client to be able to connect to resources outside of the VPN tunnel, a split tunnel must be configured. This will allow the adapter to inherit routes outside of it's own route table as well as allow the traffic out. Adding routes upon connect is only part of the issue.

Here is a link with instructions for the ADM and CLI http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/70917-asa-split-tunnel-vpn-client.html

192.168.0.0/16 is directly connected at US & 172.16.0.0/16 is directly connected at UK. As per the running-config, the site to site tunnels are allowed to pass traffic between 192.168.0.0/16 & 172.16.0.0/16. Also traffic between same security level is permitted. Also you are having manual identity NAT configuration at both firewall. Web-vpn is configured with tunnel-specified split-tunneling and the alternative addresses are permitted. Routing configurations are also correct.

So it should work perfectly.

Can you check below,

1. route print at the vpn client machine to see whether alternate location destinations are routed through tunnel only.

2. Connection logs at the firewalls while user trying to connect.

3. Debug logs to see encryption, decryption happening while trying to connect from vpn client machine.

4. Since it is 9.X, can you try ping tcp by spoofing the VPN Client IP address as source from one firewall to other firewall destination?

Example

From UK Firewall try this,

ping tcp 192.168.49.3 22 source 172.16.200.152 23423