Asynchronous routing needed - but Pix logs "connection spoof"

[hardware]

Hi,

we have a PIX 515 - Version 6.1(2) - in use with one external und 2 internal

interfaces.

Because of our technical structure, there are connections from outside, which go trought one internal interface in but the answers go throught the other internal interface out.

The Pix drops such connections with "Deny tcp connection spoof from X.X.X.X to Y.Y.Y.Y". First, we thought that the setting "ip verify reverse-path interface outside" was responsible. This setting was left by mistake from our old configuration. So we turned it off "no ip verify reverse-path interface outside", saved and reloaded the pix.

But the Pix continues dropping such connections.

Are there other options that generate such log entries?

(I haven't found additionals infos in the manual)

Yours

Armin Hammer

[shannong]

Is it really desired that the return traffic leave on a different interface? Or is this an indirect consequence of something else?

The pix just doesn't like asymetric routing of any kind. It's ASA doesn't know how to handle it.

Creative nat and Policy routing in front of or behind the Pix can take care of routing problems so that traffic comes and goes throught the "correct" interface.