No link between devices on the inside interface

[Hamood Rehman]

Hello Support Community,

We are in the process of setting up a DR site. DR site has network up and running and can talk to internet and the corporate site. Corporate site however can not talk to the DR site because the ASA at the DR site drops the TCP ACK SYN because the SYN from Corp does not go through the DR ASA. DR ASA sees the ACK SYN because it is the default gateway of DR servers. Please see the simplified diagram.

Any suggestions? Thanks.

[Julio Carvajal · Accepted solution]

Hello Hamood,

This is the expected behavior of a security firewall as he is seeing an asymetric flow ( Routing issue)

The work around is the TCP state bypass policy,

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b2d922.shtml

Rate all the answers, for the community that is as important as a thanks

Regards,

Juliio

[edatwyler · Accepted solution]

My preferred method would be to bring the routing at the DR site down to the switch if that point to point link is your preferred  connection.  Or, you could figure out a way to send Corp-To-DR traffic over your VPN tunnel.

[Hamood Rehman]

Thanks,

We decided to replace the 2960 at DR with a 3750 and change the DG on DR servers to the 3750. But that means travelling to DR site (5 Hours!), so in the meantime I will configure TCP Bypass and see how it goes.

We plan on configuring the VPN later as a back up.

Thanks again for suggestions, good info.