cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

560
Views
0
Helpful
3
Replies
Hamood Rehman
Beginner

No link between devices on the inside interface

Hello Support Community,

We are in the process of setting up a DR site. DR site has network up and running and can talk to internet and the corporate site. Corporate site however can not talk to the DR site because the ASA at the DR site drops the TCP ACK SYN because the SYN from Corp does not go through the DR ASA. DR ASA sees the ACK SYN because it is the default gateway of DR servers. Please see the simplified diagram.

Any suggestions? Thanks.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Julio Carvajal
Advisor

Hello Hamood,

This is the expected behavior of a security firewall as he is seeing an asymetric flow ( Routing issue)

The work around is the TCP state bypass policy,

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b2d922.shtml

Rate all the answers, for the community that is as important as a thanks

Regards,

Juliio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

edatwyler
Beginner

My preferred method would be to bring the routing at the DR site down to the switch if that point to point link is your preferred  connection.  Or, you could figure out a way to send Corp-To-DR traffic over your VPN tunnel.

View solution in original post

3 REPLIES 3
Julio Carvajal
Advisor

Hello Hamood,

This is the expected behavior of a security firewall as he is seeing an asymetric flow ( Routing issue)

The work around is the TCP state bypass policy,

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b2d922.shtml

Rate all the answers, for the community that is as important as a thanks

Regards,

Juliio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

edatwyler
Beginner

My preferred method would be to bring the routing at the DR site down to the switch if that point to point link is your preferred  connection.  Or, you could figure out a way to send Corp-To-DR traffic over your VPN tunnel.

View solution in original post

Thanks,

We decided to replace the 2960 at DR with a 3750 and change the DG on DR servers to the 3750. But that means travelling to DR site (5 Hours!), so in the meantime I will configure TCP Bypass and see how it goes.

We plan on configuring the VPN later as a back up.

Thanks again for suggestions, good info.

Content for Community-Ad