Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Strange DMZ behavior after upgrade to ASA 8.4(4)

I upgraded a pair of ASA 5520s from ASA 8.3 to ASA 8.4(4) this week and now my DMZ hosts cannot reliably communicate with eachother. I have a DMZ network of 10.20.20.16/28 configured. 10.20.20.17 is the ASA/Gateway and 10.20.20.19 is one host and 10.20.20.20 is another host. These two hosts had no problem communicating with eachother before the upgrade. Now, they usually cannot communicate with eachother. Occasionally they can communicate, but only for a few minutes. What is strange is I never had any access lists for these hosts to talk with eachother before the upgrade (because their traffic to eachother should have never reached the firewall) but now I needed to create an access list on the DMZ interface allowing these two hosts to talk. ICMP works fine, but only if the ACL is in place. TCP rarely works.

I started a TAC but Cisco seems to be stumped.

Any ideas?

Thanks

2 REPLIES
New Member

Strange DMZ behavior after upgrade to ASA 8.4(4)

So I have found a workaround for the issue. If I disable proxy arp on the DMZ interface the hosts can communicate with eachother. However I don't know how this is going to affect their ability to communicate with other DMZs or NATTED hosts yet.

Strange DMZ behavior after upgrade to ASA 8.4(4)

Hello Dylan,

Looks like  a problem with the NAT ( ARP issues) can you provide us your configuration.

Regards,

Julio

Looking for some Networking Assistance? Contact me directly at jcarvaja@laguiadelnetworking.com I will fix your problem ASAP. Cheers, Julio Carvajal Segura http://laguiadelnetworking.com
591
Views
0
Helpful
2
Replies
CreatePlease login to create content