Hi,
I am in the process of replacing an old router/firewall with a Cisco 5506-X firewall. (I'm aware that the 5506 is not a router, I'm working with what I am given..) - note that the layout is the same as with our old firewall/router and that I'm trying to avoid any changes or having to deal with MPLS / Phone service provider for multiple reasons.
The network I am dealing with is pretty poorly laid out; There's a half-managed phone system with a dedicated MPLS network for voice traffic - The MPLS router is the default gateway for VoIP equipement (Phones, Media gateways and what-not).
We have L2L VPNs between this location and other locations.
On the MPLS router, there is a static route that forwards all traffic from the voice vlan vlan100 to an interface "vlan10" of our ASA
I can ping the devices in the voice vlans but the TCP connections fail.
I made a service policy rule to bypass TCP state although now I end up with the following error;
- Routing failed to locate next hop for TCP from outside: x.x.x.x/x to vlan10:192.168.0.20/x
- Teardown TCP state-bypass connection XXXX from outside:x.x.x.x to vlan10 - 192.168.0.17 No valid adjacency
The ASA tries to establish the TCP connections through the vlan10 interface even though the IP address is directly connected to the vlan100 interface.
It makes sense because that's where the traffic is coming from but is there a way to force the traffic to vlan100 to exit through the vlan100 interface?
I'm not familiar enough with the ASAs to figure this one out and I'm not even sure it's possible to fix that without changing the routes on the voice MPLS router so that packets from vlan100 is routed through our vlan100 interface.
Here's a very high level picture of what the traffic looks like with different IPs;
Any help would be greatly appreciated!
Thanks
