Thanks Marvin That's very helpful. Best regards, Martin ... View more

Hello Dennis Good job, I think this state is normal for such a project. I'd expect some things not to work immediately and it would be suspicious if everything worked from the start :) It seems the connectivity is there (you said you could ping the web server 10.10.10.9, but not connect via HTTP). So from a routing point of view I think you are OK - no issues on the L3 switch or the static routes. It's possible that the issue is on the ASA that is dropping TCP sessions because the 3-way handshake packets don't arrive on the expected interfaces. In the log message you actually see that it's the reply from the web server 10.10.10.9 (SYN+ACK) that is being dropped. I think you need to configure a TCP state bypass on the ASA: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_tcpstatebypass.html Have a look also at this article: http://www.matthewjwhite.co.uk/2012/02/13/asymmetric-routing-with-cisco-asa-firewalls/ At the same time you said that you could reach 10.10.10.18 via HTTP so it's a little confusing why this is allowed but not 10.10.10.9. It's probably a good idea to compare the configuration of the two servers, maybe you notice some discrepancies. Do you have any NAT configured on the ASA? For the few PCs that you cannot ping from the other network, I recommend that you investigate their IP configuration - if they have the correct default gateway and can reach the other network back (also check if the network masks are correct). Best regards, Martin ... View more