https://community.cisco.com/t5/network-security/asa-traffic-keeps-bouncing/m-p/3839261#M28554 <P>Hi all,<BR />I think i have a very simple case. Consider the following topology:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="LAZmlYD.png" style="width: 409px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/34751i948CE1FCCE948E26/image-size/large?v=v2&amp;px=999" role="button" title="LAZmlYD.png" alt="LAZmlYD.png" /></span><BR /><BR />Yesterday i did a ping sweep with nmap from our AnyConnect VPN. Our internet facing firewall (where AnyConnect VPN is running) was logically reporting a TCP SYN attack and a lot of "Duplicate TCP SYN". This is behaviour i expect. BUT... For some reason, traffic to non-existing hosts keep bouncing between the 2 firewalls. Even when i disconnect my AnyConnect VPN, the traffic keeps bouncing between the 2 firewalls. This is because the Internet facing firewall is forwarding this traffic due to a /23 route in this case, and the second firewall doesn't have a route, so it's hitting the 0-route back to the internet facing route.</P><P>Now i was wondering: why isn't the TTL decreased for these packets? The packets just infinitely keep bouncing. Shunning the source on both firewalls resolves this, but i don't think that should be the right way.<BR /><BR />How can i fix this? We need the /23 route because we subnet it further, but not every host/subnet within this range is being used.</P> Tue, 16 Apr 2019 07:07:45 GMT Eric Snijders 2019-04-16T07:07:45Z https://community.cisco.com/t5/network-security/asa-traffic-keeps-bouncing/m-p/3839261#M28554 <P>Hi all,<BR />I think i have a very simple case. Consider the following topology:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="LAZmlYD.png" style="width: 409px;"><img src="https://community.cisco.com/t5/image/serverpage/image-id/34751i948CE1FCCE948E26/image-size/large?v=v2&amp;px=999" role="button" title="LAZmlYD.png" alt="LAZmlYD.png" /></span><BR /><BR />Yesterday i did a ping sweep with nmap from our AnyConnect VPN. Our internet facing firewall (where AnyConnect VPN is running) was logically reporting a TCP SYN attack and a lot of "Duplicate TCP SYN". This is behaviour i expect. BUT... For some reason, traffic to non-existing hosts keep bouncing between the 2 firewalls. Even when i disconnect my AnyConnect VPN, the traffic keeps bouncing between the 2 firewalls. This is because the Internet facing firewall is forwarding this traffic due to a /23 route in this case, and the second firewall doesn't have a route, so it's hitting the 0-route back to the internet facing route.</P><P>Now i was wondering: why isn't the TTL decreased for these packets? The packets just infinitely keep bouncing. Shunning the source on both firewalls resolves this, but i don't think that should be the right way.<BR /><BR />How can i fix this? We need the /23 route because we subnet it further, but not every host/subnet within this range is being used.</P> Tue, 16 Apr 2019 07:07:45 GMT https://community.cisco.com/t5/network-security/asa-traffic-keeps-bouncing/m-p/3839261#M28554 Eric Snijders 2019-04-16T07:07:45Z