Question in asa site-site vpn about "ident" ??

Question

hi all ,
i have a topology as
(192.168.0.0/24)LAN1----------------asa1---------------internet-----------------------asa2------------------LAN2(192.168.2.0/24)
now , lan 1 can reach lan 2 by site to site vpn
but i have a question :
when i have
#sh crypto ipsec sa
====================================================================
interface: outside
    Crypto map tag: Azure_IPSecCryptoMap, seq num: 2, local addr: xxxx
      access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 any
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
      current_peer: xxxxx
      #pkts encaps: 294823, #pkts encrypt: 294823, #pkts digest: 294823
      #pkts decaps: 208795, #pkts decrypt: 208795, #pkts verify: 208795
      #pkts compressed: 0, #pkts decompressed: 0
      #pkts not compressed: 294823, #pkts comp failed: 0, #pkts decomp failed: 0
      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
      #send errors: 0, #recv errors: 0
      local crypto endpt.: xxxxxxxxxx/0, remote crypto endpt.: xxxxxxxx/0
      path mtu 1500, ipsec overhead 74, media mtu 1500
      current outbound spi: 81F3ABF6
      current inbound spi : FAE91312
    inbound esp sas:
      spi: 0xFAE91312 (4209578770)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 10670080, crypto-map: Azure_IPSecCryptoMap
         sa timing: remaining key lifetime (kB/sec): (4373327/621)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0xFFFFFFFF 0xFFFFFFFF
    outbound esp sas:
      spi: 0x81F3ABF6 (2180230134)
         transform: esp-aes esp-sha-hmac no compression
         in use settings ={L2L, Tunnel, PFS Group 2, }
         slot: 0, conn_id: 10670080, crypto-map: Azure_IPSecCryptoMap
         sa timing: remaining key lifetime (kB/sec): (4370375/621)
         IV size: 16 bytes
         replay detection support: Y
         Anti replay bitmap:
          0x00000000 0x00000001
================================================================================
my problem is ,
that my asa1 lan1  only reach asa2 if its destination was to subnet 192.168.2.0/24 , i mean if  requested internet i cant reach it !!!
note that the crypto_map acl says destination "any" will go to asa2 , but why  when i requested the destioantion of lan2 it responce , and if i requested 8.8.8.8 it dont reach asa2 ??
i used packet tracer to investigate  , it seems as a stuck !!!
how to change the remote idnet as in the red line above ??? i think it is the issue that preventing mefrom reaching internet by asa2
agian ,
what issue in the asa has relation to the remote idnet and how i can change it ?
any help ?
regards

Answer 1

CSCO,
The lines below, match the interesting traffic for this VPN. You will not see a specific host address unless, you configure that within you crypto ACL. Basically you have some host in network 192.168.0.0/24(LOCAL) going to 192.168.2.0/24(REMOTE). The REMOTE IDENT is the remote network where the remote host relies, which matches your interesting traffic.
So lon story short, you have some local host in the 192.168.1.0/24 range going to some host in the 192.168.2.0/24 range.
This ACL has to do with the address you map to the match address line of you crypto map.
      access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 any
      local ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
      remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)