Hi You lot,
I'm sure I have inherited the flakiest of flaky ASA 5525 running 9.10 because I had the problem last week of a VPN that wouldn't work on both of it's interesting local hosts until I put it through the packet tracer.
Today's problem again concerns a VPN, but this time I have the Interesting hosts behind the DMZ interface and the DMZ-QA interface working fine. If I run them through the packet tracer it shows them hitting 12 go-no go points, then being sent down the VPN to the remote Interesting host. However, the Interesting host behind the Inside interface only gets through one go -no go point and on the second one it gets dropped. If I click on the "show rule that dropped" it takes me to the cleanup (any any drop) rule at the end of the interface rule list. the packet appears to have passed through a rule specifically allowing it to hit this cleanup rule.
So why would the ASA pass a packet through a rule specifically allowing it and drop the packet on the cleanup rule?
