Hi,
The main thing that always comes to mind with 8.4(3) software specifically with connectivity problems is the fact that they introduced changes related to ARP on that software.
So for example if you had an "outside" interface on the ASA configured with one public IP address range directly and the ISP also allocated you with another public address space that they configured on their gateway device directly then this so called "secondary" subnet would stop working for this ASA software.
The reason for that is because they change the ASA so that it no longer inserts information to its ARP table from non-connected subnets (which the secondary public subnet used for Static NAT would be)
The solution in these cases would be to ask the ISP to route the secondary subnet towards the current "outside" interface IP address of the ASA or you should upgrade to a newer software like 8.4(5) perhaps where you can use the command "arp permit-nonconnected"
If you dont have such setup however we would need to look for the problem elsewhere.
You could for example use the "packet-tracer" command to simulate an example connection
packet-tracer input outside tcp 1.2.3.4 12345 1720
Or some other ports. I am not sure what is used.
Naturally looking at the configuration it would be easier to look for any configuration problems.
- Jouni
