Wouldnt this happen in any situation where the DMZ server is hosting Web/HTTP services to the outside world and someone was connecting to it and loading web page contents?
Do you have any logs capture so share with us of the situation?
This sounds like normal behavior as long as there is a packet before the outbound packet from the outside host making a request to your web server on tcp/80. The random high port is the port the requester will listen on for the reply. A packet capture using the ASA packet capture wizard will let you see for sure.
Learn, share, save
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
