customer has been using a pix to terminate clients and remote site vpns across the internet. the customer also has a Border manager proxy for Internet access for all users( internal and VPN), so for vpn user internet access was from client -> Pix -> Border manager-> internet router and vice versa.
see enclosed diagram
Because of the limitations on the pix( split horizon) the remote site vpns were moved to a router, everything is ok except intermittent problems with the internet access. What we see is that some packets from the border manager destined for a remote site user, go straight out of the outside interface of the border manager instead of going to the vpn router to be encrypted
I have done sniffer traces on all interfaces but caannot see anything. What we do see is the route changes on the border manager, but as there is only static routing I cannot see why
