I ran into a little bit of an odd issue this morning. I have a site-to-site VPN tunnel that is up and correctly passing traffic between two sites. Interesting traffic is specified as a /24 at the remote site, and /16 at the headend, and the IPSEC SA is coming up correctly based off of the ACL that specifies that traffic. The head end has multiple subnets, a core router...etc. The remote end is a single subnet.
The tunnel is up, and traffic is passing over the tunnel (not traffic to the static devices, traffic to DHCP devices)... for whatever reason though, I was unable to ping devices statically assigned at the remote end from the head end. As soon as I logged into the ASA5505 at the remote end and initiated a ping directly to the static devices, pings from the head end started working. I've never seen this type of behavior from an ASA before, and I've installed dozens of them in similar fashion. Anyone know why this is happening? Maybe an arp setting, or something of the sort?
The ASA at the remote end is on 9.1(6)6. The head-end firewall is a provider-hosted context on a Palo Alto firewall.