Hi,
Can you issue the "packet-tracer" command again on that same ASA unit (twice)
Could you also tell us between which devices are you attempting to ICMP? This cant be done from the ASA directly atleast so I assume that you are ICMP between hosts? Have you confirmed that those hosts are attached to the correct ports and have the correct IP addresses and gateways if you have change the INSIDE -> DMZ for this setup on the other ASA?
I cant see no problem with the configurations at the moment. They should enable the L2L VPN negotiation to go through. But as you saw, you didnt have the configuration above on the other ASA that defines the local and remote networks on the L2L VPN connection so I think the ASDM might have removed that during some configurations.
You can naturally add the following commands on both ASAs for ICMP
fixup protocol icmp
fixup protocol icmp error
Those are old format commands but should convert to "inspect" command
Alternatively you can add them in the following way
policy-map global_policy
class inspection_default
inspect icmp
inspect icmp error
Can the ASAs ping eachothers WAN interfaces at the moment?
When you issue the "packet-tracer" command or have a continuous ICMP from some host behind the "EWVPN" interface or "inside" on the other ASA, what can you see with the command
show crypto ikev1 sa
Try to issue it several times during testing to see what it shows
You could also use the command
show crypto ipsec sa
To view if the Phase2 has gone through and if packets have gone through the L2L VPN in either direction.
There is always a chance that something else than the ASA is stopping the ICMP traffic.
- Jouni
