There are two things I'm trying to solve which are essentially the same problem.
- Cannot ping from the ASA to remote devices over a site to site VPN terminated on the ASA.
- ASA AnyConnect LDAP lookups for an LDAP server over a VPN also does not work.
I have the management-access command added so that the LDAP server can ping the inside interface over the VPN.
Here is relevant config
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 123.123.123.2 255.255.255.248
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 10.10.10.254 255.255.255.0
!
object network Branch2
subnet 192.168.78.0 255.255.255.0
!
access-list outside_cryptomap_1 extended permit ip 10.10.10.0 255.255.255.0 object Branch2
!
nat (inside,outside) source static NETWORK_OBJ_10.10.10.0_24 NETWORK_OBJ_10.10.10.0_24 destination static Branch2 Branch2 no-proxy-arp route-lookup
!
crypto map outside_map 2 match address outside_cryptomap_1
crypto map outside_map 2 set peer 123.123.123.3
crypto map outside_map 2 set ikev1 transform-set ESP-AES-256-SHA
!
management-access inside
{}
).