topic No link between devices on the inside interface in Network Security

No link between devices on the inside interface

Hamood Rehman — Mon, 11 Mar 2019 23:51:30 GMT

Hello Support Community,

We are in the process of setting up a DR site. DR site has network up and running and can talk to internet and the corporate site. Corporate site however can not talk to the DR site because the ASA at the DR site drops the TCP ACK SYN because the SYN from Corp does not go through the DR ASA. DR ASA sees the ACK SYN because it is the default gateway of DR servers. Please see the simplified diagram.

Any suggestions? Thanks.

No link between devices on the inside interface

Julio Carvajal — Fri, 07 Sep 2012 17:45:58 GMT

Hello Hamood,

This is the expected behavior of a security firewall as he is seeing an asymetric flow ( Routing issue)

The work around is the TCP state bypass policy,

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b2d922.shtml

Rate all the answers, for the community that is as important as a thanks

Regards,

Juliio

No link between devices on the inside interface

edatwyler — Fri, 07 Sep 2012 19:51:36 GMT

My preferred method would be to bring the routing at the DR site down to the switch if that point to point link is your preferred connection. Or, you could figure out a way to send Corp-To-DR traffic over your VPN tunnel.

No link between devices on the inside interface

Hamood Rehman — Tue, 11 Sep 2012 15:40:09 GMT

Thanks,

We decided to replace the 2960 at DR with a 3750 and change the DG on DR servers to the 3750. But that means travelling to DR site (5 Hours!), so in the meantime I will configure TCP Bypass and see how it goes.

We plan on configuring the VPN later as a back up.

Thanks again for suggestions, good info.