Cannot ping all hosts in the same subnet across site2site VPN
I have a simple yet weird problem I could not explain. Corp VPN gateway is ASA5520 running 7.2 code, branch VPN gateway is ASA 5505 running 8.0 code, I created a simple L2L IPsec between the two to protect communications between HQ subnet (10.0.0.0/8) and branch networks (172.30.0.0/20). IPsec tunnel comes up fine. On the branch side, inside VLAN (subnet 172.30.0.0/24) has two devices attached to it, one is a C2801 CCME router on a stick, the other one is a C3560 which terminates all subnets carved out of 172.20.0.0/20. Since the license we have on ASA5505 does not support trunking, the uplink port on C3560 to ASA is configured as switch port, a L3 VLAN is configured on C3560, its IP address is on the same subnet as ASA5505's inside VLAN and C2801's uplink. C3560 has one default route pointing to ASA's Inside VLAN IP address.
Simple enough right? not so, from corp network I can always ping C2801, but I can not always ping C3560's L3 VLAN IP on the same subnet. After I manually clear IPsec SA on either ASA5505 or ASA5520, I will be able to ping C3560, but after a while, it stops ping again.
If I send continuous ping, after a while it would recover.
Debug icmp trace on HQ ASA5520 shows that echo requests were received from inside interface, but ASA5505 in remote end does not seem to receive them. IPsec SA between corp networks and branch networks look fine on both ASAs. I don't understand what is the difference between C3560's IP and C2801's IP from either ASA's point of view?
Re: Cannot ping all hosts in the same subnet across site2site VP
Just for the record, the root cause was that we exceeded inside host limit. I don't remember where I got the impression that the inside host limit is for Internet connection only, VPN connection does not count. I was wrong.
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...