vpn anyconnect can't ping interface vlan (split tunnel)

[leo.gunadi1]

from user vpn (split tunnel) can't ping device interface vlan, please need advice. thanks

interface Redundant1.208
description testpingvpn
vlan 208
nameif inside_testpingvpn
security-level 75
ip address 10.71.8.1 255.255.255.0 standby 10.71.8.2
!

access-list split-tunnel standard permit 10.72.161.0 255.255.255.0

webvpn
enable outside
anyconnect image disk0:/anyconnect-win-4.1.04011-k9.pkg 1
anyconnect enable
tunnel-group-list enable
cache
disable
error-recovery disable
group-policy GroupPolicy_Mgmt internal
group-policy GroupPolicy_Mgmt attributes
wins-server none
dns-server none
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split-tunnel
default-domain none
address-pools value VPN-Pool

access-list inside_testpingvpn_access_in extended permit ip any any

[Rob Ingram]

Hi,

You don't have the 10.71.8.0/24 network as part of your split-tunnel ACL

access-list split-tunnel standard permit 10.71.8.0 255.255.255.0

If you wanted to ping the ASAs internal interface over the VPN you would need the following command

management-access <interface-name>

HTH

[leo.gunadi1]

hai,

sorry, i mean

access-list split-tunnel standard permit 10.71.8.0 255.255.255.0, no access-list split-tunnel standard permit 10.72.161.0 255.255.255.0

left is ip add user vpn 172.16.10.61 and right is ping interface vlan 208

but if ping from switch to gateway (ASA) reply

switch access>ping 10.71.8.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.71.8.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/3 ms

[Rob Ingram]

Have you configured a NAT exemption rule to ensure the traffic is not unintentially natted?

[leo.gunadi1]

do you mean that? thanks

[Rob Ingram]

No

Example: nat (INSIDE,OUTSIDE) source static LAN LAN destination static RAVPN RAVPN no-proxy-arp

[leo.gunadi1]

nat (any,outside) source static any any destination static VPN_ADMIN VPN_ADMIN no-proxy-arp route-lookup

object network VPN_ADMIN
range 172.16.10.2 172.16.10.100

i create new test

outside (vpn - 172.16.10.64) - ASA - Core - Switch (interface vlan 151-10.72.151.249 and interface vlan 161-10.72.161.22)

* note : 1 switch 2 ip management

ping from user vpn to 10.72.151.249 - OK

ping from user vpn to 10.72.161.22 - NG

file vpn.docx result test ping from tool asdm, please review my result. thanks