* *ASA supports Asymmetric routing in version 8.2(1) and later. You will need to configure TCP state bypass on the ASA
http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_tcpstatebypass.html On Thu, Jul 29, 2010 at 6:40 PM, wolfz <[email protected]> wrote: > Jimmy, > > Do you enable DSR? > > Regards, > > > > -----Mensagem original----- > De: [email protected] > [mailto:[email protected]] Em nome de Jimmy Stewpot > Enviada em: Thursday, July 29, 2010 4:29 AM > Para: Jimmy Stewpot > Cc: [email protected] > Assunto: Re: [f-nsp] serveriron traffic flow for SMTP > > Hi All, > > When I set the servers default gateway to the VIP IP rather than the router > IP the system began to function as I had hoped. > > Regards, > > Jimmy. > > ----- Original Message ----- > From: "Jimmy Stewpot" <[email protected]> > To: [email protected] > Sent: Thursday, 29 July, 2010 3:43:15 PM > Subject: [f-nsp] serveriron traffic flow for SMTP > > Hello, > > I currently have a problem which I am trying to find a simple solution to. > I > am hoping that someone here will be able to provide some tips. We have an > SMTP VIP which has two real servers associated with them. In front of the > Load balancer we have a Cisco ASA firewall which has permit rules for SMTP > to both real servers and the VIP on port 25 both directions. The inbound > email comes to port 25 on the VIP and then gets load balanced to the > respective real servers without any problems. However the return connection > comes back directly to the gateway which resides on the ASA. The problem is > that the ASA then has no session and rejects the SYN ACK and the > connections > are not established. The simple solution is to use source-nat but that > removes any possible use of rbl's and black lists because every source > address appears as the VIP IP. > > Is there any easy way around that while still allowing us to have the smtp > restrictions required (e.g. rbls etc). > > > sh ver > SW: Version 10.2.01nTI4 Copyright (c) 1996-2007 Foundry Networks, Inc. > Compiled on Feb 01 2010 at 20:02:55 labeled as WJR10201n > HW: Stackable Router, SYSIF version 21, Serial #: Non-exist > > Regards, > > Jimmy Stewpot. > _______________________________________________ > foundry-nsp mailing list > [email protected] > http://puck.nether.net/mailman/listinfo/foundry-nsp > _______________________________________________ > foundry-nsp mailing list > [email protected] > http://puck.nether.net/mailman/listinfo/foundry-nsp > > _______________________________________________ > foundry-nsp mailing list > [email protected] > http://puck.nether.net/mailman/listinfo/foundry-nsp >
_______________________________________________ foundry-nsp mailing list [email protected] http://puck.nether.net/mailman/listinfo/foundry-nsp
