I recently upgraded a customer from a PIX 525 (running 7.0 code) to a pair of ASA 5550s in active/standby mode. The ASA runs 8.02. The customer uses a software identity service called Trusted Network Technologies 'Identity', which communicates with a server on the outside of the firewall. The software requires that TCP sequence number randomization be turned off, and that the TCP Urgent flag status is preserved through the firewall.
After upgrading to the ASA, the TNT software no longer functions. The software vendor is telling me that there may be some conflicts in the ACLs used for NAT and the TCP map.
Here is the portion of the config that I believe to be relevant. Any ideas?
access-list global_mpc extended permit ip any y.y.0.0 255.255.0.0
class-map OCDE-class
match access-list global_mpc
!
policy-map global-policy
class OCDE-class
set connection random-sequence-number disable
set connection advanced-options OCDE-map
tcp-map OCDE-map
urgent-flag allow
global (outside) 101 x.x.x.127 netmask 255.255.255.0
global (outside) 103 x.x.x.129 netmask 255.255.255.0
nat (inside) 103 access-list inside_nat_outbound norandomseq
nat (inside) 101 0.0.0.0 0.0.0.0