Did you find a solution to this issue? I have the same problem and even a fresh install and upgrading to 3.0.1 did not fix the issue. ... View more

Yeah they won't be, it was the same issue with me even when I provided them packet captures of my laptop directly connected to the modem with the out of order packets. I agree it is definitely something in the FWSM that is killing the download. When I had my laptop connected to the modem large downloads completed fine, but I was not being firewalled and windows was able to handle the fragmentation. If TAC comes back with a command to help the issue I would be interested in knowing it. ... View more

Yes, but you stated that the packet capture outside the FWSM module also had the out of order packets and re-transmissions. You could possibly resolve the issue by changing something on the FWSM, but I think the root of you problem would not be solved. I don't know of any commands that will help with fragmentation on the ASA so I won't be much help there. ... View more

I can't say for certain, but based on packet tracers I remember I believe it would be dropped during the ACL check and it would say dropped by "implicit rule". So my guess would be Step 4. If you have access to a test system I would recommend testing it with a packet tracer, it might shed some light on it for you. ... View more

I had this issue once on a 2800 router acting as their firewall. The firewall is having trouble dealing with an excessive amount of fragmented packets. We tried upgrading, but it did not help. ISP said it was not on their side, but eventually the customer saw their truck down at the corner working on something, after that there were no more fragmented packets and no more downloading issues. So I would have a call with your ISP as well, unless you can download large files internally. ... View more

This is possible as far as I can tell. I did this with fewer ISPs, 2 at HQ and one at the remote sites. That being said it should not be too much different. I think the key is the loopback interfaces for the tunnel destinations and sources. Each site would need to have 2 loopbacks one for each tunnel you create, you could likely reuse them at the HQ site. This would allow you to change the ACLs for the VPNs and determine which HQ router the tunnel terminates on.   So HQ1 lo1 would be 10.0.0.100/32 and the RS1a lo1 would be 10.0.0.1/32, HQ2 lo1 10.10.10.100/32 and RS2b lo1 would be 10.10.10.1/32. For RS2 you would use HQ1 lo1 and HQ2  l2 and RS2a lo1 would be 10.0.0.2/32 RS2b lo2 would be 10.10.10.2/32. I think this would make logical sense once you add multiple sites in. I highly recommend you plan all the IP scheme out before hand to make sure it is manageable in the end.   As for HSRP you can use it, just have the routers are the RS participate in eigrp with each other and the the primary will send any routes to the standby that has a better metric for. If the primary goes down the standby will take over all the routing.   I should mention that while this should work, I have noticed the more you try to build in redundancy the more odd things will happen. This is due to the additional complexity that comes with additional redundancy. I am not saying you should not do it, but figured it was worth mentioning.   Good Luck and I hope this was helpful.     ... View more

This is a little old, but I just had the same issue and thought I would share my fix. I found it be an issue with some of my IP addresses have a space before the mask. I imported one and got that to go through, then just imported sections at a time. When it failed I looked through to find the issue, for me it was always a space in the IP address field. ... View more

Well this is really interesting. I just checked th release notes again and found the following note was added. Cisco 3350 and 3310 series mobility services engines are not supported from Release 7.4 onwards. This was not the case a month or so ago. Sorry for the confusion, but it seems that it is no longer supported. ... View more

I can confirm that the 3350 does in fact support 7.4 code. I was told two different things by TAC, first one told me it was supported and the second one said no, but after pushing and pointing out that the documentation supported it he admitted that it was in fact supported, but would not run Mobile Conceirge. Currently it is installed and has been running for over a month. There was an issue on the MSE, but a call to TAC got it resolved and to my knowledge there was no issues with it being on 7.4. ... View more

Apparently the MSE 3350 is supported on the 7.4.100 code. I was told by TAC to download and install the 3355 software. ... View more

Thanks for the effort on this, it really helped to point me in the right direction. I tried it out and it was not working because even though it gets sent to the interface properly it looks for a route once it gets to that interface and fails. I was able to set the default route pointing out the WAN-SEC interface and then put the below routes pointing out the WAN interface. route WAN 0.0.0.0 128.0.0.0 10.2.101.1 1 route WAN 128.0.0.0 128.0.0.0 10.2.101.1 1 Since they are more specific normal traffic flows out the WAN interface while the NAT'd traffic is sent out the other interface. I confirmed it is working using packet captures. ... View more

I suppose it could be an issue if the cpu is overwhelmed during a rekey. Considering this is a branch office router it could be an issue. I would just try it on the lower settings for a week to see if it resolves the issue. Also you could try an pull the debugs from the other side, usually one side of the VPN has the more relevant logs. ... View more

TAC is the Cisco Technical Support Center. Unfortunately this was almost 2 years ago so I dont think they will be doing anything about it. You can only open a support case if your equipment is under a support contract. Is there a particular reason you chose the level of encryption you are using? It is the most secure, but also the most processor intensive, I personally have never seen this combination used. I would recommend AES128 with DH Group 2 and SHA hash. What debug commands did you use to produce those logs? Where you looking at ipsec or just isakmp? ... View more