Cisco ASA intermittently fails to see traffic
Posted
by DrStalker
on Server Fault
See other posts from Server Fault
or by DrStalker
Published on 2009-09-21T04:23:29Z
Indexed on
2010/04/19
5:13 UTC
Read the original article
Hit count: 657
users
|
Mikrotik -- Internet
|
ASA
|
ServerA and ServerB
I'm trying to troubleshoot a problem with a new Cisco ASA 5505. The network design is as above - the Microtik is the existing router, ServerA and ServerB used to plug directly into it.
ServerA has IP 10.30.1.10, ServerB has IP 10.30.1.11 The ASA is configured with no NAT, a "allow anything" firewall, and uses the microtik as its default gateway. In effect, it is currently a simple IP router; the firewall and VPN stuff will all come later once the basics are working.
Th problem is access to ServerA and ServerB is erratic - sometimes it will work, sometimes it will fail. It can fail for either one of the servers only, or both.
When it is working: The Mikrotik logs show ping packets being sent out over the proper interface The ASA logs show the incoming connections.
When it is failing: The Mikrotik logs show ping packets being sent out over the proper interface The ASA logs show nothing reaching the ASA.
This can fail for one server only (e.g.: the Mikrotik is putting out packets to 10.30.1.10 and 10.30.1.11, but the ASA is only seeing packets arrive destined for 10.30.1.11) It can fail for one source only (e.g.: ClientA on the users network can ping 10.30.1.11, but clientB cannot) The problem can also be seen from the mikrotik router itself; sometimes it can ping ServerA and ServerB, sometimes it can only ping one of them
What could be causing this? I can't think of any possible cause that is intermittent and could explain why the problem may occur for one destination server and not others.
edit: Link to ASA config
© Server Fault or respective owner