4: 10:37:09.632840 10.22.1.62 > 10.22.20.1: icmp: time exceeded in-transit Drop-reason: (acl-drop) Flow is denied by configured rule 5: 10:37:13.346493 10.22.1.62 > 10.22.20.1: icmp: time exceeded in-transit Drop-reason: (acl-drop) Flow is denied by configured rule 6: 10:37:17.346966 10.22.1.62 > 10.22.20.1: icmp: time exceeded in-transit Drop-reason: (acl-drop) Flow is denied by configured rule It is interesting that ICMP time exceed packets that are generated from Port-channel1.90 are dropped on ASP due to acl-drop, as if the packets are leaving the box and apparently coming back. Can you please check asp-drop capture with detail option to see what are the source and destination MAC addresses on these packets? ... View more

You can try to bypass SW2 and connect ASA directly to SW1. Sometimes unexpected behaviour happens on virtual environment. ... View more

OK, if you want to see ASA in the output, you can enable decrementing TTL, as Marvin showed. ... View more

Internal-Data and control interfaces are configured by the system and do not require any attention. You can ignore them.   'Failed to locate egress interface for UDP from LAN1-HO-ge1:169.254.185.218/137 to 169.254.255.255/137' means that firewall receives NETBIOS traffic sent probably by a Windows machine on LAN1-HO-ge1 interface that failed to get IP address from DHCP and used APIPA. You can investigate why the machine does not get IP address. ... View more

Are you trying to traceroute directly to the ASA (to-the-box) or through ASA? 10.22.10.62 is assigned to outside, and traceroute is initiated to 10.22.10.63, which is on the same subnet as outside. If traceroute is intended to 10.22.10.63 and ASA supposed to route this traffic, then packet should come to outside and leave outside. If so, then this is a same-security-traffic intra-interface traffic, and it should be enabled. Otherwise please explain how traffic should flow. ... View more

Is this happening in a virtual environment like EVE or are all of them hardware appliances? Connetivity is not bidirectional, SW1 stops receiving hello packets from the ASA, while ASA receives hello packets from the. You can try to disable igmp snooping on sw2 and see how it behaves. ... View more

In your configuration there is an object named NAT with IP range and NAT definition: object network NAT nat (INSIDE,OUTSIDE) dynamic NAT+PAT object network NAT range 10.10.0.1 10.10.0.5 object-group network NAT+PAT network-object object NAT-POOL network-object object PAT-POOL 'show nat' shows that there is an auto-NAT rule that translates whatever is configured in object named NAT to whatever configured in object-group named NAT+PAT. Auto NAT Policies (Section 2) 1 (INSIDE) to (OUTSIDE) source dynamic NAT NAT+PAT translate_hits = 10, untranslate_hits = 0 ... View more

The source of the ping is  10.10.0.10, which is not included in    object network NAT range 10.10.0.1 10.10.0.5  For this reason auto-nat will not be used.  ... View more

Inline VLAN pairing on NGIPS can be created using a switched interface and logical switched interfaces. Basically the physical interface needs to have Switched mode, and then logical switched interfaces with specific VLAN tags can be added. ... View more

Is it correct that when "nat (inside,outside) source static any any no-proxy-arp route-lookup" is removed" from Internal firewall, clients are able to get addresses from the DHCP server? If yes, then in terms of DHCP workflow and at packet level what specifically is the difference when this nat exists on Internal ASA? It can be useful to analyze packet captures on ASA outside, DHCP server and clients in the non-working scenario. ... View more

Yes, but the point is to confirm that when SW1 is reloaded, connectivity between ASAs over interfaces C and D is in place. If units cannot contact all due to issues in the transmission path, split brain will occur. If units cannot or do not contact when there are no issues in the transmission path and split brain still occurs, then the case needs further analysis. ... View more