ACS SE Replication through Firewall

Unanswered Question
Nov 20th, 2007

Hi all,

I'am setting up replication on a pair of ACS SE 3.3. ACS's are on two diffrent Subnet separated by a Firewall.

The 'AAA Server' tab are filled with tha same key on both server (self + remote).

I have set up the ACS001 to replicate to ACS002.

Altough i can see the tcp session on port 2000 established in the firewall log, in the ACS001 log i can see 'SRO-ACS002 not responding' after 5 minutes (i.e. the replication timeout).

Any idea ?

Thank you very much.



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
miklos.andrasi Wed, 11/21/2007 - 06:51

Hi Laurent!

I assume you use 7.x.x softver on the PIX or ASA. If the situation is it, the skinny inspection drops the ACS replication packets. Unfortunately there is a bug that you can't see the packets that are dropped by the SKINNY inspection.

I hope I could help you.

Best Regards,

Miklos Andrasi


lolichet Wed, 11/21/2007 - 08:44

Hi Miklos,

Thank you for your answer. The customer is using Netscreen Firewalls, not PIX or ASA.

I will try to check if there is a special treatment for skinny trafic.


Best regards,



This Discussion