Cisco ASA-5505 - Can ping the Internet from LAN connected devices, however I cannot ping from the LAN interface to the Internet

Question

I am new to Cisco ASA and ASDM. Struggling with difference from IOS devices. Network layout is as follows:

AWS VPC -- IPsec tunnel -- ASA-5505 -- LAN

Currently:

1. IPsec tunnel is up.
2. AWS can reach LAN connected devices.
3. LAN connected devices can reach the internet.

However I have these two problems:

1. LAN interface of ASA cannot ping to Internet.
2. SLA monitoring isn't working. (Maybe related to point 1?)

Below I have inserted most of my running-config(and route table). I removed the crypto config and I have hid some octets of WAN addresses with xxx. Hopefully there is enough configuration here to be helpful in troubleshooting. If some additional information would be helpful please ask.

(Sorry, there was probably a better way to format the running-config below.)

ciscoasa# show running-config  
: Saved  
:  
ASA Version 9.1(2)8  
!  
interface Ethernet0/0  
 switchport access vlan 2  
!  
interface Ethernet0/1  
!  
interface Ethernet0/2  
!  
interface Ethernet0/3  
!  
interface Ethernet0/4  
!  
interface Ethernet0/5  
!  
interface Ethernet0/6  
!  
interface Ethernet0/7  
!  
interface Vlan1  
 nameif inside  
 security-level 100  
 ip address 192.168.0.1 255.255.255.0  
!  
interface Vlan2  
 nameif outside  
 security-level 0  
 ip address xxx.152.29.xxx 255.255.255.240  
!  
ftp mode passive  
object network inside-subnet-1  
 subnet 192.168.0.0 255.255.255.0  
object network AWS-inside-subnet  
 subnet 172.19.254.128 255.255.255.128  
object network NETWORK_OBJ_192.168.0.0_24  
 subnet 192.168.0.0 255.255.255.0  
object-group protocol DM_INLINE_PROTOCOL_1  
 protocol-object ip  
 protocol-object icmp  
access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 192.168.0.0 255.255.255.0 object AWS-inside-subnet  
pager lines 24  
logging enable  
logging asdm informational  
mtu outside 1500  
mtu inside 1500  
no failover  
icmp unreachable rate-limit 1 burst-size 1  
no asdm history enable  
arp timeout 14400  
no arp permit-nonconnected  
nat (inside,outside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static AWS-inside-subnet AWS-inside-subnet  
!  
object network inside-subnet-1  
 nat (inside,outside) dynamic interface  
route outside 0.0.0.0 0.0.0.0 xxx.152.29.xxx 1  

http server enable  
http 192.168.0.0 255.255.255.0 inside  
no snmp-server location  
no snmp-server contact  

sla monitor 1  
 type echo protocol ipIcmpEcho 172.19.254.129 interface outside  
 frequency 30  
sla monitor schedule 1 life forever start-time now  
!  
ssh 192.168.0.0 255.255.255.0 inside  
ssh timeout 20  
ssh key-exchange group dh-group1-sha1  
console timeout 0  
!  
!  
class-map inspection_default  
 match default-inspection-traffic  
!  
!  
policy-map type inspect dns preset_dns_map  
 parameters  
  message-length maximum client auto  
  message-length maximum 512  
policy-map global_policy  
 class inspection_default  
  inspect dns preset_dns_map  
  inspect ftp  
  inspect h323 h225  
  inspect h323 ras  
  inspect rsh  
  inspect rtsp  
  inspect esmtp  
  inspect sqlnet  
  inspect skinny  
  inspect sunrpc  
  inspect xdmcp  
  inspect sip  
  inspect netbios  
  inspect tftp  
  inspect ip-options  
  inspect icmp  
!   
: end  
ciscoasa# show route  

Gateway of last resort is xxx.152.29.xxx to network 0.0.0.0  

C    xxx.152.29.xxx 255.255.255.240 is directly connected, outside  
C    192.168.0.0 255.255.255.0 is directly connected, inside  
S*   0.0.0.0 0.0.0.0 [1/0] via xxx.152.29.xxx, outside  
ciscoasa#  

Answer 1

To get the IP SLA to work, change your crypto ACL from:

access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 192.168.0.0 255.255.255.0 object AWS-inside-subnet  

to :

access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 any4 object AWS-inside-subnet

And, of course, do the same (in reverse) at the remote peer.

This way the IP SLA (which is sourced from the ASA's outside ip address) also gets tunnelled.

src: http://www.tunnelsup.com/troubleshooting-vpn-between-cisco-asa-and-amazon-aws

Edit: note that if there is any traffic between AWS and the Internet, the suggested config change may break things as it may cause that traffic to traverse the tunnel now (depending on how the other side is configured).

Edit2: this should also make a regular ping work, if you source it from the outside interface. To be honest I'm not sure if a ping from the inside interface can ever work - it might if you enable management-access inside. That should at least allow you to ping the inside interface from AWS.

Answer 2

Type these commands in the CLI (starting from the config you provided):

management-access inside
access-list outside_cryptomap extended permit ip object NETWORK_OBJ_192.168.0.0_24 object AWS-inside-subnet
no access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 192.168.0.0 255.255.255.0 object AWS-inside-subnet
nat (inside,outside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static AWS-inside-subnet AWS-inside-subnet no-proxy-arp route-lookup
nat (inside outside) after-auto source dynamic any interface
object network inside-subnet-1
no nat (inside,outside) dynamic interface
exit
ip sla monitor 1
no type echo protocol ipIcmpEcho 172.19.254.129 interface outside
type echo protocol ipIcmpEcho 172.19.254.129 source-ipaddr 192.168.0.1
exit
track 1 rtr 1 reachability

After you type the above commands, exit configuration mode and clear the ipsec sa to restart the tunnel. The SLA monitor should start working. If not, you might want to try another 192.168.0.x address for the source-ip parameter.

Also, your ASA IOS image is very old! It is possible you are encountering a VPN bug. I highly recommend upgrading to 9.1(7)19 (asa917-19-k8.bin)

See https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160210-asa-ike for more information