I've deployed a Cisco virtual ASA in Azure to use as a VPN server. For simplicity, I'm using just the management interface as the lan for the time being (10.2.0.4 is the interface). I want to use the ASA as the VPN server rather than Azure's built-in VPN capability. I'm able to use Cisco Anyconnect to establish a VPN connection to my virtual ASA. However, when I then pull up Remote Desktop Client to connect to my virtual client at 10.2.0.5, it fails to make a connection. Using wireshark, I can see the port 3389 RDC connection attempts coming in to 10.2.0.5 from 10.2.0.10, which is the virtual IP that ASA assigned when I made the initial VPN connection. However I don't see any traffic from 10.2.0.5 back. It looks like 10.2.0.5 is trying to use ARP to get the MAC address for 10.2.0.10 so it can respond, but it's not getting any ARP reply. If Cisco ASA VPN is distributing 10.2.0.10 as a virtual IP, shouldn't it respond to the ARP request?
Keep in mind that networking in the cloud works a bit differently than it does in the real world. ARP for instance does not work as you would expect: it's the cloud controller that answers the ARP request, not the device on which the IP address is configured. This means that Azure must know at all times what IP addresses are on what devices.
In order to route traffic to an instance (such as the ASA) on an IP address that is not assigned (by Azure) to the interface, you need to create a User Defined Route in the VNET. So it's best to create a seperate subnet for VPN clients, and add a route to that subnet that points to the ASA appliance.
Also keep in mind you need to enable IP forwarding for the instance, or "transit" traffic will be dropped by Azure anyway.