I've configured a site-to-site VPN tunnel from a Cisco ASA to a ER605.  The VPN tunnel shows to be up and I do have SA's that show to be up as well.  When testing connectivity I am advised by the end-users that they still cannot connect to resources that are on the ASA side of the tunnel.  I am in the process of having them reattempt connectivity so that I can pull traffic statistics and run a packet capture to ensure that encaps/decaps are being seen on the tunnel.  Does anybody know if there is any additional configuration to permit traffic on the ER605?  My assumption is that because the tunnel is establishing that the firewall is seeing it as a trusted source/interface and it would not apply any firewall rules to the traffic.  I can also run a packet trace from the cisco and it is telling me that traffic between the two lans is permitted, encaps/decaps statistics are incrementing as expected and the ER605 shows traffic statistics for the LAN traffic as well.