Oh, and configure the load balancer for DSR. Or just set the default back to the load balancer, like you did already.
On Thu, Jul 29, 2010 at 8:20 PM, George B. <[email protected]> wrote: > * *ASA supports Asymmetric routing in version 8.2(1) and later. > > You will need to configure TCP state bypass on the ASA > > > http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/conns_tcpstatebypass.html > > > > > On Thu, Jul 29, 2010 at 6:40 PM, wolfz <[email protected]> wrote: > >> Jimmy, >> >> Do you enable DSR? >> >> Regards, >> >> >> >> -----Mensagem original----- >> De: [email protected] >> [mailto:[email protected]] Em nome de Jimmy Stewpot >> Enviada em: Thursday, July 29, 2010 4:29 AM >> Para: Jimmy Stewpot >> Cc: [email protected] >> Assunto: Re: [f-nsp] serveriron traffic flow for SMTP >> >> Hi All, >> >> When I set the servers default gateway to the VIP IP rather than the >> router >> IP the system began to function as I had hoped. >> >> Regards, >> >> Jimmy. >> >> ----- Original Message ----- >> From: "Jimmy Stewpot" <[email protected]> >> To: [email protected] >> Sent: Thursday, 29 July, 2010 3:43:15 PM >> Subject: [f-nsp] serveriron traffic flow for SMTP >> >> Hello, >> >> I currently have a problem which I am trying to find a simple solution to. >> I >> am hoping that someone here will be able to provide some tips. We have an >> SMTP VIP which has two real servers associated with them. In front of the >> Load balancer we have a Cisco ASA firewall which has permit rules for SMTP >> to both real servers and the VIP on port 25 both directions. The inbound >> email comes to port 25 on the VIP and then gets load balanced to the >> respective real servers without any problems. However the return >> connection >> comes back directly to the gateway which resides on the ASA. The problem >> is >> that the ASA then has no session and rejects the SYN ACK and the >> connections >> are not established. The simple solution is to use source-nat but that >> removes any possible use of rbl's and black lists because every source >> address appears as the VIP IP. >> >> Is there any easy way around that while still allowing us to have the smtp >> restrictions required (e.g. rbls etc). >> >> >> sh ver >> SW: Version 10.2.01nTI4 Copyright (c) 1996-2007 Foundry Networks, Inc. >> Compiled on Feb 01 2010 at 20:02:55 labeled as WJR10201n >> HW: Stackable Router, SYSIF version 21, Serial #: Non-exist >> >> Regards, >> >> Jimmy Stewpot. >> _______________________________________________ >> foundry-nsp mailing list >> [email protected] >> http://puck.nether.net/mailman/listinfo/foundry-nsp >> _______________________________________________ >> foundry-nsp mailing list >> [email protected] >> http://puck.nether.net/mailman/listinfo/foundry-nsp >> >> _______________________________________________ >> foundry-nsp mailing list >> [email protected] >> http://puck.nether.net/mailman/listinfo/foundry-nsp >> > >
_______________________________________________ foundry-nsp mailing list [email protected] http://puck.nether.net/mailman/listinfo/foundry-nsp
