I found the solution to this eventually, with some help. The issue was that on the ASR side, the tunnel was in its default configuration which uses GRE, which the ASA doesn't support. The solution was to change the tunnel mode to ipsec ipv4 like so: interface Tunnel5 tunnel mode ipsec ipv4 With this done, bidirectional traffic was possible over the tunnel.

Only top voted, non community-wiki answers of a minimum length are eligible