Hi all,
I've opened a new thread for this issue (was: "asymmetric multihoming &
nat").
Having an issue on an ASA device (8.2(4)) with tcp-state-bypass enabled.
Despite these configs:
access-list tcp_state_bypass_acl extended permit ip any host 12.0.1.28
access-list tcp_state_bypass_acl extended permit ip host 12.0.1.28 any
!
class-map tcp_state_bypass
match access-list tcp_state_bypass_acl
!
policy-map global_policy
class tcp_state_bypass
set connection advanced-options tcp-state-bypass
!
service-policy global_policy global
(note that these configs are for test traffic, hence referencing only a
single host)
I am still seeing the logs
2011-01-26 16:53:59 Local4.Debug 10.10.30.3 %ASA-7-609001:
Built local-host outside:12.0.1.28
2011-01-26 16:53:59 Local4.Info 10.10.30.3 %ASA-6-106015: Deny
TCP (no connection) from 12.0.1.28/23 to 204.8.80.5/54015 flags SYN ACK
on interface outside
2011-01-26 16:53:59 Local4.Debug 10.10.30.3 %ASA-7-609002:
Teardown local-host outside:12.0.1.28 duration 0:00:00
Supposedly configuring tcp-state-bypass on the ASA should allow this
traffic, but it doesn't seem to be working.
I'm not seeing hits on the ACL either:
access-list tcp_state_bypass_acl line 1 extended permit ip any host
12.0.1.28 (hitcnt=0)
access-list tcp_state_bypass_acl line 2 extended permit ip host
12.0.1.28 any (hitcnt=0)
Could this be a bug? Am I missing something obvious?
I even added
tcp-map synackallow
synack-data allow
invalid-ack allow
!
class syn_ack_allow
set connection advanced-options synackallow
!
policy-map global_policy
class syn_ack_allow
set connection advanced-options synackallow
in case that would help. Nope, it did not.
Thanks,
Adam
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
