Can ping ASA inside interface but not inside network

[mwaltner12]

So something weird was happening when we were setting up a VPN connection yesterday (tunnel is up now and passing traffic). Here is a diagram of our topology:

(10.26.0.0/16)--ASA-1-------------ASA-2--(192.168.1.0)

So our tunnel didn't come up right away, but while troubleshooting I found that from inside network on ASA 1 I could pass traffic just fine to the ASA 2 inside interface (192.168.1.1), but I could not get traffic to any other host on that network. During this troubleshooting, there was not a no-nat statement for the network 192.168.1.0/24 which explains why I could not get to any hosts, but how was I able to reach the inside interface which is also on that network?

I was not able to find any documentation or other peoples experiences explaining this. Is it because the traffic to the interface is still local in the ASA and not inbound to the inside interface?

[MHM Cisco World]

Share the config for both asa

MHM

[mwaltner12]

I can, but I forgot to specify that the tunnel is up and passing traffic just fine now, I just thought that was a weird behavior. Do you still want the configs?

[MHM Cisco World]

If it work at end, then no need to share config

You meantion tunnel and no-nat,

This confuse me 

VPN is policy based or router based VPN?

MHM

[mwaltner12]

It is policy based.

So I could see that there was a SA between the two ASA's, but I could only ping ASA inside interface on the remote network (192.168.1.1) and not the rest of the hosts on the network. After adding this statement:

nat (inside,outside) source static NETWORK_OBJ_192.168.2.1_24 NETWORK_OBJ_192.168.1.0_24 destination static MAIN-SITE-PO MAIN-SITE-PO no-proxy-arp route-lookup

I could connect to every host just fine.

[MHM Cisco World]

why we need No-NAT 
let see the traffic flow of ping from remote to local

1-traffic from Remote LAN to local LAN

This traffic is decrypt and send to local LAN

2- traffic return from local LAN to remote LAN

3- usually we use dyanimc NAT for local (inside) to internet' this dynamic NAT nating the return traffic and hence it not hit the ACL abd dont encrypt

Here come the no-NAT 

We config no-NAT to make retrun traffic bypass dynamic and keep it original IP hit the ACL and encrypt

So this normal behave of ASA policy based VPN

MHM

[mwaltner12]

I do understand that, but why was I able to talk to 192.168.1.1 without the no-NAT config?

[Rob Ingram · Accepted solution]

@mwaltner12 do you perhaps have "management-access <interfacename>" configured? that would allow icmp (as well as mgmt traffic) over the VPN tunnel to the ASA's far interface.

[MHM Cisco World · Accepted solution]

Any NAT have boundary' this boundary is build from source to destiantion interface nameif

Dynamic NAT command include two nameif Inside and Outside 

and here is trick

The asa interface itself is use  identity as nameif not Inside 

And this make it traffic bypass NAT automatically (no need NAT)

The traffic from inside interface will be mark as coming from Inside nameif and hence hit dyanmic NAT and need NO-NAT to bypass it

MHM

[mwaltner12]

I figured there it was bypassing it somehow, I just couldn't find anything that said how. Thank you @MHM Cisco World and @Rob Ingram