Azure to ASA site to site policybase VPN. Cannot reach Azure subnet from ASA

[Viboosha paliyaguru]

i have recently configured a azure to asa site to site policy base vpn. Devices on the inside subnet can reach azure subnet. But when i try to ping azure subnet from ASA it fails. This makes LDAP authentication to fail since the ASA cant reach the LDAP server on the azure subnet. i executed a trace route to azure subnet it ends up heading out of outside interface not the vpn tunnel.

[Rob Ingram]

Hi,
The source of the LDAP traffic would be your outside interface ip address, try including your outside IP address in your crypto ACL.

HTH

[Viboosha paliyaguru]

The LDAP sever is connected via the VPN and devices on the inside subnet
can reach the server and i have tested authentication with LDP.exe tool
work fine. I am having trouble figuring out why the asa cannot connect with
LDAP server via the VPN.

[Viboosha paliyaguru]

Through the inside interface

[Rob Ingram]

Are you referring to LDAP authentication to the ASA itself, i.e. for RAVPN or mgmt authentication?

[Viboosha paliyaguru]

RAVPN

[Rob Ingram]

Right, so when the ASA communicates with the LDAP server (on the end of the VPN tunnel) it will attempt to communicate using it's outside interface IP address, is that IP address defined in your crypto ACL (used to define the interesting traffic)?

[Viboosha paliyaguru]

Yes it is the public IP of the azure subnet

[Rob Ingram]

No. The public/outside IP address of the ASA will need to be included in the crypto ACL that defines the interesting traffic for the VPN tunnel.

[Viboosha paliyaguru]

Would this work 

My outside interface of ASA is 103.31.114.116

Azure subnet are: 10.0.0.0 ,10.0.1.0

access-list Azure-acl line 2 extended permit ip object 103.31.114.116-ASA-OUTSIDE object-group Azure-NET (hitcnt=0) 0x306ca30a
access-list Azure-acl line 2 extended permit ip host 103.31.114.116 10.0.0.0 255.255.255.0 (hitcnt=0) 0x3eeca94b
access-list Azure-acl line 2 extended permit ip host 103.31.114.116 10.0.1.0 255.255.255.0 (hitcnt=0) 0xcd0de5a4