managing ASA using private interface accross IPSec tunnel

[tato386]

I am using a pair of ASA5515s running 9.5 to connect two sites using a L2L IPSec tunnel.  The tunnel works fine for hosts on each of the two private subnets but the ASA units themselves cannot be reached or managed  (ICMP, ASDM, etc) accross the tunnel using a private IP on one side of the tunnel to the private network interface of the ASA on the other side of the tunnel. 

I guess what is happening is that the ASA is using its "closest" interface which is the public interface to try to send packets to the remote private subnet but if this is the case how can I tell it to use its private interface and IP?

Thanks,
Diego

[S-Lemming · Accepted solution]

You need to specify management access to the inside interface. Just run the command in global config: management access <interface name>

Hope this helps.

[tato386]

Cool, syslog across the tunnel is working now which is probably the most important thing I needed.  However ASDM and ICMP still don't go even though I specifically allow both of these on all interfaces.  Any ideas?

Thank you very much,

Diego

[S-Lemming]

If you are trying to ping between the ASAs you need to specify the inside interface as source interface, otherwise it will use the closest interface which is the outside and the packet will not be encrypted.

On the ASA you want to reach through VPN, please set the ASDM access rule to allow the remote subnet on the inside interface (which you specified as the management interface above).

Let me know how it goes.

[tato386]

I believe I am allowing all subnets ICMP and ASDM using the following commands and also sourcing ping from inside interface.  Is there something else I am missing?

icmp permit any inf_Inside
icmp permit any inf_Outside

http 0.0.0.0 0.0.0.0 inf_Inside
http 0.0.0.0 0.0.0.0 inf_Outside

Thanks,

Diego