There are two things I'm trying to solve which are essentially the same problem.
- Cannot ping from the ASA to remote devices over a site to site VPN terminated on the ASA.
- ASA AnyConnect LDAP lookups for an LDAP server over a VPN also does not work.
I have the management-access command added so that the LDAP server can ping the inside interface over the VPN.
Here is relevant config
interface GigabitEthernet1/1 nameif outside security-level 0 ip address 220.127.116.11 255.255.255.248 ! interface GigabitEthernet1/2 nameif inside security-level 100 ip address 10.10.10.254 255.255.255.0 ! object network Branch2 subnet 192.168.78.0 255.255.255.0 ! access-list outside_cryptomap_1 extended permit ip 10.10.10.0 255.255.255.0 object Branch2 ! nat (inside,outside) source static NETWORK_OBJ_10.10.10.0_24 NETWORK_OBJ_10.10.10.0_24 destination static Branch2 Branch2 no-proxy-arp route-lookup ! crypto map outside_map 2 match address outside_cryptomap_1 crypto map outside_map 2 set peer 18.104.22.168 crypto map outside_map 2 set ikev1 transform-set ESP-AES-256-SHA ! management-access inside