Hi,
I have a CSS11150 with an SSL Accelerator SCA11000 connected on one of the CSS Ethernet Port. The CSS itself is connected with its GE interface on a Catalyst. Only one VLAN is defined, so the CSS, the SCA and a router are on the same subnet. The default gateway configured in the SCA is the router, not the CSS. I thought first it was a mistake because the return flow from the SCA would pass through the CSS at Layer-2 without interception by the CSS! So I decided to NAT the client address when sending encrypted packets to the SCA to solve this issue.
But, I realized that it works also without NATing the client ! So I concluded that the CSS is able to intercept a packet arriving on one of its interface and associate this packet with a established flow, even if this packet is not destined to the CSS.
Can you confirm this behaviour ? What is the recommendation ?
Thank you ,
Yves
