Good Morning. I have just bought a new SA 2500 for SSL VPN and a new SSG5 for sperate a DMZ. Network Diagram                                                                          --------SA2500(Interal Port)                                                                          | Internet-----(Untrucst)SSG140(DMZ)-----switch(DMZ)-----(Untrust)SSG5(Trust)-----switch(Internal)--------Internal Resource Detail SSG 140 DMZ interface  : 192.168.0.254 SA2500 Internal interface : 192.168.0.200 SSG5 Untrust interface  : 192.168.0.253 SSG5 Trust Interface  : 192.168.90.253     I try to set the SA 2500, I notice that I can connect the SSL VPN (network connect) outside, and I use the whatismyip to check the global IP, the result is the public IP of the location of SA 2500, but I can not access any internal resource in the DMZ and the internal resource. In SA2500, I do the setting with below step 1.create the user(User001) in the [auth servers>system local>Users], 2.create the roles(UserRoles01) in the [User roles], and enable the feature. 3.create the realms(HKPool)in the [User Realms], and set the auth server to use system local, role mapping UserRoles01 to * user. 4.create a new signing in page and map */HK_User/ -->New Page-->HKPool, and enable the multiple user sessions. 5.In [Resource Policies->Network connect->Network connect access control], I see there is default *:* all roles allow. 6.In [Resource Policies->Network connect->NC Connection Profiles], I set the 192.168.30.2-192.168.30.100 IP pool for all roles. 7.In [Resource Policies->Network connect-> Split-tunneling Networks], I set the Resources range is 192.168.30.0/24(VPN Pool), 192.168.0.0/24(DMZ), 192.168.90.0/24(Internal). 8.In [Netowork->Network Connect], I set the Network Connect Server IP Address is 192.168.30.200. After I set that, I can can access the sa2500 from outside but can not access the machine in DMZ and internal, Do I miss any setting?   ... View more