There are two subnets behind this firewall. The directly connected one is 10.10.33.0/24 and the other network 10.11.33.0/24 is one hop away from the firewall.
The "inside" interface address of the firewall is 10.10.33.4/24.
This ASA is used to terminate a VPN tunnel; I have the sysopt connection permit VPN command on this device so all VPN traffic is allowed though.
Because of this, on the outside interface I have a deny any any statement.
So here is the problem. I am seeing something interesting in the logs of this ASA. It looks like the inside interface is trying to ping some lightweight access points on the 10.11.33.0/24 subnet. The controller for these access points is not at the remote location, the controller is at the main campus. The logs indicate that the access list on the outside interface is denying icmp from the inside interface of the ASA (10.10.33.4).
Do you know if the wireless controllers might be generating these packets? And somehow the ASA is acting as a proxy or something for the ICMP packets? Even if this was the case it does not make sense as to why traffic “coming from” 10.10.33.4 would be dropped by the outside access-list. Unless something is spoofing the address of the inside interface of the ASA…
I've looked though the logs of the ASA's at other remote sites with similar configurations and this site is the only one that this is happening at. I have not found any obvious configuration differences.
The version on the ASA is 8.4.(1), I’m going to look thought the bug notes again. Maybe there is something there I have missed.
We are pleased to announce availability of Beta software for 16.6.3. 16.6.3 will be the second rebuild on the 16.6 release train targeted towards Catalyst 9500/9400/9300/3850/3650 switching platforms. We are looking for early feedback from custome...