Route Inside IP through Tunnel - ASA 5506

[iceman183]

Hi, I have a ASA 5506 (Site A) in which I have multiple tunnels set up. One of those tunnels have the same IP Range as ASA5506 inside one. I set up the tunnel with a 10.4.10.193/26 (Site A) and the Site-to-Site Tunnel (Site B) is behind the 10.4.10.1/25 along with 10.5.10.0/25 range. Yet, I'm unable to ping or connect from behind the ASA server -10.4.10.222 (Site A) to 10.4.10.50 (Site B) while I am able to ping and connect to the other subnet range - 10.5.10.50 (Site B) from 10.4.10.222 (Site A).

I'm fairly new to firewalls and networking so any help is appreciated. Is there something special I have to do to force the inside IP to route through tunnel.

My cisco asa config is mentioned below. Important information has been hidden or changed.

: Saved

: 
: Serial Number: 
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.8(2) 
!
hostname ASA5506
enable password * encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 55.44.33.22 DataPipegateway description Datapipe
ip local pool vpnpool 10.2.10.200-10.2.10.250 mask 255.255.255.0

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 5.30.192.65 255.255.255.248 
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 10.4.10.193 255.255.255.192 
!
interface GigabitEthernet1/3
no nameif
security-level 100
no ip address
!
interface GigabitEthernet1/4
no nameif
security-level 100
no ip address
!
interface GigabitEthernet1/5
no nameif
security-level 100
no ip address
!
interface GigabitEthernet1/6
no nameif
security-level 100
no ip address
!
interface GigabitEthernet1/7
no nameif
security-level 100
no ip address
!
interface GigabitEthernet1/8
no nameif
security-level 100
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group network ASA-C
network-object 172.16.0.0 255.240.0.0
network-object 192.168.0.0 255.255.0.0
network-object 10.0.0.0 255.0.0.0
object-group network allow-b
network-object 192.168.20.0 255.255.255.0
network-object 192.168.55.0 255.255.255.0
object-group network final
network-object 10.4.10.0 255.255.255.128
network-object 10.5.10.0 255.255.255.0
access-list VPN-2 extended permit ip 10.4.10.0 255.255.255.0 172.30.99.0 255.255.255.0 
access-list SPLIT 192.168.20.0 255.255.255.0
access-list SPLIT 10.4.10.0 255.255.255.0
access-list C-tunnel extended permit ip 10.4.10.0 255.255.255.0 object-group allow-b
access-list D-tunnel extended permit ip 10.4.10.0 255.255.255.0 10.2.1.0 255.255.255.0 
access-list E-tunnel extended permit ip 10.4.10.192 255.255.255.192 object-group final 
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
asdm image disk0:/asdm-782.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (any,any) source static ASA-C ASA-C destination static ASA-C ASA-C no-proxy-arp
!
object network obj_any
nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 5.30.192.41 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL 
aaa authentication http console LOCAL 
aaa authentication enable console LOCAL 
aaa authentication login-history
http server enable
http 0.0.0.0 0.0.0.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-ARS256-SHA esp-aes-256 esp-sha-hmac 
crypto ipsec ikev1 transform-set transform-E esp-aes esp-sha-hmac 
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-256
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 20 set reverse-route
crypto dynamic-map outside_dyn_map 40 set pfs group1
crypto dynamic-map outside_dyn_map 40 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 set reverse-route
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 match address VPN-2
crypto map outside_map 1 set peer 202.25.194.3 
crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 1 set ikev2 ipsec-proposal AES256
crypto map outside_map 1 set security-association lifetime seconds 28800
crypto map outside_map 1 set reverse-route
crypto map outside_map 2 match address C-tunnel
crypto map outside_map 2 set peer 59.41.122.65 
crypto map outside_map 2 set ikev2 ipsec-proposal AES256
crypto map outside_map 2 set security-association lifetime seconds 28800
crypto map outside_map 3 match address D-tunnel
crypto map outside_map 3 set peer 18.60.61.25 
crypto map outside_map 3 set ikev1 transform-set ESP-3DES-MD5
crypto map outside_map 3 set ikev2 ipsec-proposal AES256
crypto map outside_map 3 set reverse-route
crypto map outside_map 4 match address E-tunnel
crypto map outside_map 4 set pfs 
crypto map outside_map 4 set peer 50.35.164.25
crypto map outside_map 4 set ikev1 transform-set transform-E
crypto map outside_map 4 set security-association lifetime seconds 3600
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpool policy
crypto isakmp identity address 
crypto isakmp nat-traversal 30
crypto ikev2 policy 10
encryption aes-256
integrity sha256
group 5 2
prf sha256
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes-256
integrity sha256
group 2
prf sha256
lifetime seconds 28800
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 ipsec-over-tcp port 10000 
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 28800
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 5
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 160
authentication pre-share
encryption aes
hash sha
group 2
lifetime 28800
telnet timeout 5
console timeout 0
management-access inside

dhcpd auto_config outside
!
dhcpd address 10.2.10.240-10.2.10.250 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy REMOTE internal
group-policy REMOTE attributes
vpn-idle-timeout 86400
vpn-session-timeout none
vpn-tunnel-protocol ikev1 ssl-client ssl-clientless
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT
user-authentication-idle-timeout none
dynamic-access-policy-record DfltAccessPolicy
username demouser345 password B0nt5eERtePVmGs. encrypted privilege 5
tunnel-group 202.25.194.3 type ipsec-l2l
tunnel-group 202.25.194.3 ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
tunnel-group REMOTE type remote-access
tunnel-group REMOTE general-attributes
address-pool vpnpool
default-group-policy REMOTE
tunnel-group REMOTE ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group 59.41.122.65 type ipsec-l2l
tunnel-group 59.41.122.65 ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
tunnel-group 18.60.61.25 type ipsec-l2l
tunnel-group 18.60.61.25 ipsec-attributes
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
tunnel-group 50.35.164.25 type ipsec-l2l
tunnel-group 50.35.164.25 ipsec-attributes
ikev1 pre-shared-key *****
isakmp keepalive threshold 10 retry 10
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map 
inspect ftp 
inspect h323 h225 
inspect h323 ras 
inspect rsh 
inspect rtsp 
inspect esmtp 
inspect sqlnet 
inspect skinny 
inspect sunrpc 
inspect xdmcp 
inspect sip 
inspect netbios 
inspect tftp 
inspect ip-options 
inspect icmp 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
Cryptochecksum:10309bceef4a0bfd401a94a96b260e96
: end

[Rob Ingram]

Hi,
Does it actually establish a VPN (IPSec SA) between Site A and Site B?
Can you provide the output of "show crypto ipsec sa detail" for the peer 50.35.164.25?
Can you also run packet-tracer on Site A ASA from Site A network to Site B network and upload the output here.
E.g:- packet-tracer input inside tcp 10.4.10.22 2102 10.4.10.50 23