I am doing my test pings from the LAN interfaces of each device so was expecting pings to go through tunnel.
Thanks for the packet-tracer suggestion, ive done it and results below.
Still struggling...
Firewall-ASA-xxxe# packet-tracer input inside icmp 192.168.202.2 8 0 172.16.100.12 detailed
Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop xxxWAN IP ADDRESSxxx using egress ifc outside
Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,outside) source static NETWORK_OBJ_192.168.202.0_24 NETWORK_OBJ_192.168.202.0_24 destination static NETWORK_OBJ_172.16.100.0_24 NETWORK_OBJ_172.16.100.0_24 no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface outside
Untranslate 172.16.100.12/0 to 172.16.100.12/0
Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7f87e10f2110, priority=501, domain=permit, deny=true
hits=2, user_data=0x7, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=192.168.202.2, mask=255.255.255.255, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=any
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
Firewall-ASA-xxxx#
.png){kind=link}
.png){kind=link}