Hi all,
I think i have a very simple case. Consider the following topology:
Yesterday i did a ping sweep with nmap from our AnyConnect VPN. Our internet facing firewall (where AnyConnect VPN is running) was logically reporting a TCP SYN attack and a lot of "Duplicate TCP SYN". This is behaviour i expect. BUT... For some reason, traffic to non-existing hosts keep bouncing between the 2 firewalls. Even when i disconnect my AnyConnect VPN, the traffic keeps bouncing between the 2 firewalls. This is because the Internet facing firewall is forwarding this traffic due to a /23 route in this case, and the second firewall doesn't have a route, so it's hitting the 0-route back to the internet facing route.
Now i was wondering: why isn't the TTL decreased for these packets? The packets just infinitely keep bouncing. Shunning the source on both firewalls resolves this, but i don't think that should be the right way.
How can i fix this? We need the /23 route because we subnet it further, but not every host/subnet within this range is being used.
