Доброе время суток.
Возникла необходимость стыковаться изнутри по VPN на внешний сервер. Между клиентом и сервером стоит ASA5505 version 7.2(2):

клиент VPN <---> ASA5505 <---> сервер VPN

Клиент стандартный виндовой. При попытке соединения клиента, вылетает ошибка 619. Хотя без промежуточной Циски все работает.

вот конфига
hostname ciscoasa
domain-name default.domain.invalid
enable password PLBb27eKLE1o9FTB encrypted
names
!
interface Vlan103
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan104
nameif outside
security-level 0
pppoe client vpdn group ххх
ip address pppoe
!
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
retries 1
name-server 62.231.161.9
name-server 208.67.222.222
domain-name default.domain.invalid
same-security-traffic permit inter-interface
access-list racces extended permit tcp any host х.х.х.х eq 3380
access-list racces extended permit tcp any host х.х.х.хeq 3355
access-list racces extended permit tcp any host х.х.х.х eq 3341
access-list racces extended permit tcp any host х.х.х.х eq 3340
access-list racces extended permit icmp any host х.х.х.х
access-list racces extended permit tcp any host х.х.х.х eq 3381
access-list alownat extended permit ip 192.168.0.0 255.255.255.0 any
access-list alownat extended permit ip 192.168.1.0 255.255.255.0 any
access-list ICMPACL extended permit icmp any any
access-list inside_outside extended permit tcp any any eq www
access-list inside_outside extended permit icmp any any
access-list inside_outside extended permit udp any any eq domain
access-list inside_outside extended permit tcp any any eq aol
access-list inside_outside extended permit tcp any any eq smtp
access-list inside_outside extended permit tcp any any eq pop3
access-list inside_outside extended permit tcp any any eq 9999
access-list inside_outside extended permit tcp any any eq https
access-list inside_outside extended permit tcp any any eq 1194
access-list inside_outside extended permit tcp any any eq 3390
access-list inside_outside extended permit tcp any any eq 3389
access-list inside_outside extended permit udp any any eq 1194
access-list inside_outside extended permit tcp any any eq ftp
access-list inside_outside extended permit tcp any any eq ftp-data
access-list inside_outside extended permit tcp any any eq 8080
access-list inside_outside extended permit tcp any any eq 3355
access-list inside_outside extended permit tcp any any eq pptp
access-list inside_outside extended permit gre any any
access-list FTPACL extended permit tcp any any eq ftp
access-list FTPACL extended permit tcp any any eq ftp-data
access-list alow_vpn extended permit ip 192.168.5.0 255.255.255.0 any
pager lines 24
mtu inside 1500
mtu outside 1500
ip local pool user_vpn 192.168.1.100-192.168.1.110 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
nat-control  
global (outside) 1 interface
nat (inside) 0 access-list alow_vpn
nat (inside) 1 access-list alownat
static (inside,outside) tcp interface 3341 192.168.1.2 3307 netmask 255.255.255.255
static (inside,outside) tcp interface 3340 192.168.1.2 3306 netmask 255.255.255.255
static (inside,outside) tcp interface 3380 192.168.1.2 3380 netmask 255.255.255.255
static (inside,outside) tcp interface 3355 192.168.1.2 3355 netmask 255.255.255.255
static (inside,outside) tcp interface 3381 192.168.1.2 3381 netmask 255.255.255.255
access-group inside_outside in interface inside
access-group racces in interface outside
route outside 0.0.0.0 0.0.0.0 62.231.160.28 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy test internal
group-policy test attributes
vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
webvpn
  functions url-entry file-access file-entry file-browsing mapi port-forward filter http-proxy auto-download citrix
  svc required
username aria password hrQJD8m6imkmheRR encrypted
username it_serv password pqTbTfo5OBDPP2x6 encrypted privilege 15
aaa authentication enable console LOCAL
aaa authentication telnet console LOCAL
aaa local authentication attempts max-fail 5
http server enable
http 192.168.1.2 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
tunnel-group remote_users type webvpn
tunnel-group remote_users general-attributes
address-pool user_vpn
default-group-policy test
tunnel-group remote_users webvpn-attributes
group-alias itserv enable
telnet 192.168.1.2 255.255.255.255 inside
telnet timeout 60
ssh timeout 5
console timeout 0
vpdn group test request dialout pppoe
vpdn group test localname хххх
vpdn group test ppp authentication pap
vpdn username хххх password ********* store-local

!            
class-map FTP-CLASS
match access-list FTPACL
class-map ICMP-CLASS
match access-list ICMPACL
!
!
policy-map ICMP-POLICY
class ICMP-CLASS
  inspect icmp
class FTP-CLASS
  inspect ftp
!
service-policy ICMP-POLICY global
webvpn
enable outside
svc enable
url-list Serverlist "SGATE" http://192.168.1.2 1
tunnel-group-list enable
prompt hostname context
Cryptochecksum:ef7d316890972123f3831f6e7124bc43
: end

Нашел похожее только вместо асы 2800, говорят иос обновили все заработало.
Может что в конфиге добавить надо?