ASA1 is 8.4(2) @, behind this is host1 @

ASA2 is 8.4(3) @, behind this is host2 @

Pinging form host1 to host2 works, but I can't ping that inside interface ( on ASA2 over the tunnel from host1. I'm not to sure where to start? I want to access all management features over the VPN so I have entered the following on ASA2;

ssh inside
http inside

But I can't ping, connect via SSH, or connect via ASDM to ASA2 from host1. ASA2 is already configured with management-access inside for management from machines local to it.

I don't think there is any incorrect NAT configuration here, there should be no NAT between subnets;

ASA1: nat (Inside,Outside) source static destination static

ASA2: nat (Inside,Outside) source static destination static

What can I check or change?

UPDATE OK I have run a packet capture on each ASA and pinged from ASA1 to ASA2 ad vice verse. For some reason, the ping's from the ASA's them selves aren't being sent over the tunnel.

ASA1# show capture testc access-list capture

1428 packets captured

 155: 10:55:18.745460 ASA.1.PUBLIC.IP > icmp: echo request 
 159: 10:55:18.761236 ASA.1.PUBLIC.GATEWAY > ASA.1.PUBLIC.IP: icmp: time exceeded in-transit 
 161: 10:55:20.742545 ASA.1.PUBLIC.IP > icmp: echo request 
 163: 10:55:20.758429 ASA.1.PUBLIC.GATEWAY > ASA.1.PUBLIC.IP: icmp: time exceeded in-transit 

The same results are observed on ASA2. So even though hosts on that inside subnet are using the VPN, the ASA's inside interface it's self is not. Do you think its the NAT rules above, should they have "route-lookup" on the end?

| improve this question | | | | |
  • What's the VPN crypto map look like? – Shane Madden Aug 8 '12 at 6:05

Have you tried to allow access to ssh and http from the outside interface for this subnet?

ssh outside
http outside

If you check the logging in the ASDM monitoring section you should see why your management traffic is being stopped.

| improve this answer | | | | |

Yes as I found out, I have been able to test now; I needed the "route-lookup" keyword on the end of the NAT statements. Thanks all.

| improve this answer | | | | |
  • Same issue here, static identity nat rules needed route-lookup option for management-access ping/icmp traffic to travel across the tunnel. – Mister_Tom Apr 30 '15 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.