ASA routing oddity help

acomiskey — Tue, 12 Mar 2019 09:15:36 GMT

Need a hand here trying to figure out an odd situation.

I have 2 ASAs directly connected to each other at Site A and Site B. I have site to site vpns terminating at Site A. Remote sites communicate with networks inside Site A (172.25.0.0/16). Every once in a while, I notice that my MAN connection between the 2 firewalls is saturated with 20Mb/s of traffic in each direction. It seems that Site A ASA is sending traffic from the site to site destined for 172.25.x.x towards Site B. Then site B turns around and sends the traffic back to Site A, Site A ASA then sends back to Site B. Routing ping pong? This repeats itself over and over again. Routing tables are correct in each device. Site A 5516-x should be sending traffic destined to 172.25.4.x to vlan4 interface, not GRN interface. I have no idea why this is happening.

(outside vpns, 172.16.x.x)

Site A 5516-x (GRN interface 172.27.10.17) <--------------------> Site B 5510 (177 interface 172.27.10.18)

(inside vlans, 172.25.0.0/16)

Site A sho conn

ICMP GRN 172.16.10.246:1 GRN 172.25.4.40:0, idle 0:00:00, bytes 41602656, flags X
this would also show the UDP connection shown below in Site B, but I deleted this connection (actually had to shun the ip and delete the conn as it kept reappearing)

Site A sho route
C 172.25.4.0 255.255.255.0 is directly connected, vlan4

Site B sho conn

ICMP 177 172.16.10.246:1 177 172.25.4.40:0, idle 0:00:00, bytes 9644640

UDP 177 172.16.9.5:161 177 172.25.4.20:60393, idle 0:00:00, bytes 2553741606, flags -

Site B sho route

R 172.25.4.0 255.255.255.0 [120/1] via 172.27.0.17, 0:00:21, 177

Could you please attach the

Ajay Saini — Mon, 24 Apr 2017 20:05:36 GMT

Could you please attach the running config from side A. It could be a some overlapping crypto map or NAT config that might be causing it. Also, attach show route from ASA A.

Hi Aj, thanks for the

acomiskey — Mon, 24 Apr 2017 20:09:42 GMT

Hi Aj, thanks for the response. I will have to do some sanitizing. I'll try to get it up tomorrow.

topic ASA routing oddity help in Network Security

ASA routing oddity help

Could you please attach the

Hi Aj, thanks for the