Hi,   I seem to be having some issues with my policers i have set up to police certain flows to limited bandwidth.  I have attached a simple diagram to illustrate the premise of what i am trying to do.   Essentially I have some servers in each location and they regularly transfer data between them,  to ensure that they do not flood my 2Gb Inter DC link I have applied an input service policy on the 10G router interfaces facing the switch on both sides of the link,  the ACL's to identify the traffic are a reversal of each other each side to capture traffic in both directions.     I believe that these policers are not working at the moment,  when i look at the policy map stats there are no packets being matched by the policers etc.  Also i have Netflow stats from the routers that show the two end devices were causing congestion on the link which affected other apps.   Below are sanitised configs but are the same with names and IP's changed   Router A Config class-map match-all CM_Loc_A_to_Loc_B match access-group name Loc_A_to_Loc_B policy-map PM_Loc_A_to_Loc_B class CM_Loc_A_to_Loc_B police 150000000 conform-action transmit exceed-action drop ip access-list extended Loc_A_to_Loc_B remark File transfer policer permit ip object-group Location_A object-group Location_B object-group network Location_A 10.10.10.0 255.255.255.0 object-group network Location_B 20.20.20.0 255.255.255.0 interface TenGigabitEthernet0/0/0 description Router A connection no ip address service-policy input PM_Loc_A_to_Loc_B channel-group 1 mode active interface TenGigabitEthernet0/0/1 description router A connection no ip address service-policy input PM_Loc_A_to_Loc_B channel-group 1 mode active ---------------------------------------------------------- Router B Config class-map match-all CM_Loc_B_to_Loc_A match access-group name Loc_B_to_Loc_A policy-map PM_Loc_B_to_Loc_A class CM_Loc_B_to_Loc_A police 150000000 conform-action transmit exceed-action drop ip access-list extended Loc_B_to_Loc_A remark File transfer policer permit ip object-group Location_B object-group Location_A object-group network Location_A 10.10.10.0 255.255.255.0 object-group network Location_B 20.20.20.0 255.255.255.0 interface TenGigabitEthernet0/0/0 description Router B connection no ip address service-policy input PM_Loc_B_to_Loc_A channel-group 1 mode active interface TenGigabitEthernet0/0/1 description router B connection no ip address service-policy input PM_Loc_B_to_Loc_A channel-group 1 mode active ... View more

Hi Guys, I have a two ASA firewalls at two seperate locations in place and both running in multicontext mode (Internal context and External Context) and i have configured TCP State bypass on the firewall interfaces on both the internal and external interfaces to accomodate asymmetric routing.  Now everything i have read from cisco and other places seems to suggest this will work but at the moment it doesnt What i see is as follows, TCP syn is sent From Source Device out through Firewall A Internal Context through Firewall A External Context to the destination device. TCP syn Ack is received from destination device at Firewall B External Context and is dropped (deny no connection......) the configuration i have applied is as per cisco documentation apart from my accesslist is ip any any hostname(config)# access-list tcp_bypass extended permit ip any any hostname(config)# class-map tcp_bypass hostname(config-cmap)# description "TCP traffic that bypasses stateful firewall" hostname(config-cmap)# match access-list tcp_bypass hostname(config-cmap)# policy-map tcp_bypass_policy hostname(config-pmap)# class tcp_bypass hostname(config-pmap-c)# set connection advanced-options tcp-state-bypass hostname(config-pmap-c)# service-policy tcp_bypass_policy outside So should this work should Firewall B external context just enforce the TCP State Bypass policy?  or Is my understanding of this feature wrong? Thanks Neil ... View more

Hi, Has anyone had a problem were by, when you TFTP the code to the FWSM and it then writes to the flash it locks the flash and the FWSM becomes unresponsive?? normal process we follow is COPY TFTP: FLASH:IMAGE blah blah blah.......   the image is copied across via TFTP but then the Write to flash starts gets a few lines through then stops and becomes unresponsive if we manage to get a command prompt back at some point another attempt at copying is always meet with the error Flash is currently busy.  no Wr mem's are possible either,  to get back to normal we have to reboot the module from the 6500 switch prompt with a HW-Mod Mod x reset command. We are moving from code version 3.2 (5) > 3.2 (15)  we had this problem on another FWSM we were upgrading but by some random luck it seemed to have rebooted its self and come back up with the correct version. any ideas what the problem may be? Thanks Neil ... View more