Here, we must understand that the routing capabilities of a ASA is limited compared to a router. Initially a PIX would not allowed a packet to leave an interface on the same
interface that they came in. This was improved by adding the "same-security-traffic permit intra-interface" command, wich i assume you are using. But this does not resolve everything,
because the ASA does not reroute the packet the way a router would , it creates a connection the same way it would if the packet leave the outside interface.Your problem is that
the returning packet doesn't get back to the ASA.
Let see with an example;
(I assume that the PC on the inside have the ASA as the default gateway)
172.31.0.100 make a tcp connection on 172.29.0.100. The SYN hits the ASA wich opens a connection , then route the packet to the MPLS router at 172.31.0.254.
But the returning SYN packet goes directly to the PC 172.31.0.100 because it is Directly Connected to the router. Then the PC sends the ACK to the ASA ( the default gateway)
but it is refused because the ASA never saw the returning SYN . So your TCP connection dies here.
The problem does not occur with icmp because there is no three way handshake and it doesn't matter if the replies doesn't pass through the ASA.
One solution could be to create a sub-interface on the inside interface, configure it on a /22 subnet , put the MPLS router in this subnet and create a static route in the MPLS router for your
inside network. This way it would force all returning traffic to go through the ASA.
