You and  Aditya have been on the right track the whole time. I found the source of the problem and it is not the ASA as you guys already have figured out. Apparently there is a second L3 switch behind ASA1. This switch is gateway for 172.16.61.x.  The first L3 switch is gateway for every other 172.16.x.x network and there is about 60 of those. So I assumed and/or did not look carefully enough to see that 172.16.61.x was not on this switch. When I added the routing to the second switch everything started to work. So now I will put on my "I am ashamed"-hat and stand in the corner for 10min. Thank you verry much for your help. Without you I would never have found a solution. ... View more

Intresting. So this is what the result is: If I ping from the inside of ASA2 to the inside of ASA1 I can see that the requests are comming to ASA1 but there is no reply. If I ping from the inside of ASA1 I do not se the requests being forwarded from ASA1 to ASA2.  So my conclusion is that the traffic is getting stuck somewhere, ether in L3 switch or between the switch and ASA1. I do have an ACL on the inside interface of ASA1 but that permits any any ip.  Any other ideas? Edit: I doubble checked the routing on the L3 switch and it shows that 192.168.1.0 is pointing to 172.16.61.23 (inside of ASA1).  ... View more

On 172.16.63.63 I have a webserver. So I am using that to test http/s from 192.168.1.8. (I don't trust ICMP :) ) ' management-access inside' is already enabled on ASA1, but that ping did not work. ... View more

Now it does, but still not working. ip route 192.168.1.0 255.255.255.0 172.16.61.23 There are no ACLs on the L3 switch, so I have ruled out that. ... View more

On ASA1 I did "route outside 192.168.1.0 255.255.255.0 2.2.2.2 1" That did not solve the problem. Do I have to tell the core (L3) switch that it somehow should pass the trafic to the ASA tunnel? ... View more

Here are those commands: asa1# show crypto ipsec sa interface: outside Crypto map tag: outside_map0, seq num: 2, local addr: 1.1.1.2 access-list outside_cryptomap_3 extended permit ip 172.16.0.0 255.255.0.0 192.168.1.0 255.255.255.0 local ident (addr/mask/prot/port): (172.16.0.0/255.255.0.0/0/0) remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) current_peer: 2.2.2.2 #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0 #pkts decaps: 3, #pkts decrypt: 3, #pkts verify: 3 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0 #TFC rcvd: 0, #TFC sent: 0 #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0 #send errors: 0, #recv errors: 0 local crypto endpt.: 1.1.1.2/500, remote crypto endpt.: 2.2.2.2/500 path mtu 1500, ipsec overhead 58(36), media mtu 1500 PMTU time remaining (sec): 0, DF policy: copy-df ICMP error validation: disabled, TFC packets: disabled current outbound spi: 95D4DD40 current inbound spi : 3B2D06DD inbound esp sas: spi: 0x3B2D06DD (992806621) transform: esp-des esp-sha-hmac no compression in use settings ={L2L, Tunnel, IKEv2, } slot: 0, conn_id: 1671168, crypto-map: outside_map0 sa timing: remaining key lifetime (kB/sec): (91135999/27638) IV size: 8 bytes replay detection support: Y Anti replay bitmap: 0x00000000 0x0000000F outbound esp sas: spi: 0x95D4DD40 (2513755456) transform: esp-des esp-sha-hmac no compression in use settings ={L2L, Tunnel, IKEv2, } slot: 0, conn_id: 1671168, crypto-map: outside_map0 sa timing: remaining key lifetime (kB/sec): (90112000/27638) IV size: 8 bytes replay detection support: Y Anti replay bitmap: 0x00000000 0x00000001 And on asa2: asa2# show crypto ipsec sa interface: outside Crypto map tag: outside_map, seq num: 1, local addr: 2.2.2.2 access-list outside_cryptomap_2 extended permit ip 192.168.1.0 255.255.255.0 172.16.0.0 255.255.0.0 local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (172.16.0.0/255.255.0.0/0/0) current_peer: 1.1.1.2 #pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 3, #pkts comp failed: 0, #pkts decomp failed: 0 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0 #TFC rcvd: 0, #TFC sent: 0 #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0 #send errors: 0, #recv errors: 0 local crypto endpt.: 2.2.2.2/500, remote crypto endpt.: 1.1.1.2/500 path mtu 1500, ipsec overhead 58(36), media mtu 1500 PMTU time remaining (sec): 0, DF policy: copy-df ICMP error validation: disabled, TFC packets: disabled current outbound spi: 3B2D06DD current inbound spi : 95D4DD40 inbound esp sas: spi: 0x95D4DD40 (2513755456) SA State: active transform: esp-des esp-sha-hmac no compression in use settings ={L2L, Tunnel, IKEv2, } slot: 0, conn_id: 250966016, crypto-map: outside_map sa timing: remaining key lifetime (kB/sec): (4008960/27693) IV size: 8 bytes replay detection support: Y Anti replay bitmap: 0x00000000 0x00000001 outbound esp sas: spi: 0x3B2D06DD (992806621) SA State: active transform: esp-des esp-sha-hmac no compression in use settings ={L2L, Tunnel, IKEv2, } slot: 0, conn_id: 250966016, crypto-map: outside_map sa timing: remaining key lifetime (kB/sec): (4331519/27693) IV size: 8 bytes replay detection support: Y Anti replay bitmap: 0x00000000 0x00000001 ... View more

On the asa2 side the subnet has the ASA as gateway. But on asa1 the default gateway is a L3 switch. I thought this wouldn't be a problem since the tunnel was able to go up? ... View more