Hi Phil, I think, it's not issue with 9.5(2). based on capture it looks like an issue with communication between client and server application (it's PLC from industry environment and some years ago customer has the same issue with non-cisco firewall). I will try bypass tcp state and test the communication. ... View more

sorry for that: - ASA 5585-x SSP-10, sw version 9.5.2 - when client is bypassing ASA (over old network environment including non-cisco firewall) everything is running ok. in attachment you can find two captures: ingress and egress. you can see there keepalive packet on the ingress side (after 30sec) but this keepalive is not going to egress interface. after 10-times is client sending R that is going to egress side. I have no connection table from this time but I thing connection on the asa is created because R is forwared. also I can't see any drop for this client/server ip in the log. in the ingress side you can see packets #8-18 there seq nr is out of order (seq 34, it should be 35?). when I'm right, ASA is not processing to egress side that's correct processing. I'm right? maybe this helps: class-map CM-PLC   match access-list CM-PLC policy-map global_policy  class CM-PLC   set connection advanced-options tcp-state-bypass   service-policy global_policy global ... View more

Hello Dominic, of course, is it possible to define expiration date per user basis (ACS 5.4+). I'd like solve the same issue - how to import/update users using import file including expiration date. Did you solve this 'issue'? -- martin ... View more