topic TCP Bypass on ASA 5512 and BGP peering with two ISP in Network Security https://community.cisco.com/t5/network-security/tcp-bypass-on-asa-5512-and-bgp-peering-with-two-isp/m-p/3487632#M132917 <HTML><HEAD></HEAD><BODY><P>Hello</P><P>I have BGP peering with two ISP (defaults from the both of them), the problem is that I need to put only ASA on the perimeter? and ASA is not like asymmetrical traffic.</P><P>When I had configured TCP bypass I get a lot of the "No valid adjacency" messages, I can ping any address in the internet from PC in the DMZ,but as for websites&nbsp; - the pages in the internet do not open&nbsp; from PC (but some of the pages open sometimes).</P><P>When I stopped announce our PI IP addresses to one of the providers - all works well, the problem with the asymmetrical traffic.</P><P>There is the scheme in the attachment, config file and capture from ASA</P><P>The interface of ASA connected to DMZ have IP addrees from the&nbsp; block our announced PI IP adresses, and we do not use NAT on this ASA.</P><P>Please help me to resolve this issue.</P></BODY></HTML> Sat, 12 May 2018 13:48:21 GMT cisco2016 2018-05-12T13:48:21Z TCP Bypass on ASA 5512 and BGP peering with two ISP https://community.cisco.com/t5/network-security/tcp-bypass-on-asa-5512-and-bgp-peering-with-two-isp/m-p/3487632#M132917 <HTML><HEAD></HEAD><BODY><P>Hello</P><P>I have BGP peering with two ISP (defaults from the both of them), the problem is that I need to put only ASA on the perimeter? and ASA is not like asymmetrical traffic.</P><P>When I had configured TCP bypass I get a lot of the "No valid adjacency" messages, I can ping any address in the internet from PC in the DMZ,but as for websites&nbsp; - the pages in the internet do not open&nbsp; from PC (but some of the pages open sometimes).</P><P>When I stopped announce our PI IP addresses to one of the providers - all works well, the problem with the asymmetrical traffic.</P><P>There is the scheme in the attachment, config file and capture from ASA</P><P>The interface of ASA connected to DMZ have IP addrees from the&nbsp; block our announced PI IP adresses, and we do not use NAT on this ASA.</P><P>Please help me to resolve this issue.</P></BODY></HTML> Sat, 12 May 2018 13:48:21 GMT https://community.cisco.com/t5/network-security/tcp-bypass-on-asa-5512-and-bgp-peering-with-two-isp/m-p/3487632#M132917 cisco2016 2018-05-12T13:48:21Z Re: TCP Bypass on ASA 5512 and BGP peering with two ISP https://community.cisco.com/t5/network-security/tcp-bypass-on-asa-5512-and-bgp-peering-with-two-isp/m-p/3487633#M132919 <HTML><HEAD></HEAD><BODY><P>Have you tried disable TCP Randomization?</P></BODY></HTML> Wed, 06 Jun 2018 09:47:04 GMT https://community.cisco.com/t5/network-security/tcp-bypass-on-asa-5512-and-bgp-peering-with-two-isp/m-p/3487633#M132919 Nikolaj Pabst 2018-06-06T09:47:04Z