Cisco ASA intermittantly fails to see traffic

The mikrotik has an explicit route for this subnet, and only one default route.

A little more tetsing shows that the problem only occurs if both systems are connected to the ASa (ie: it can manage one client, not 2) so I'll redo the question in a simpler form.

Rigth now, it is redundant.  Once the ASA is installed it will be used as a VPN endpoint for the inside network as well as some additional routing, but obviously before we get the VPN to work we need to have the extreme basics (plug in system, be able to reliably connect to it) working.  

After talking to Cisco support they're sending out a replacement ASA because they can't figure out what is wrong, so we'll see how that goes tomorrow.

OK,

Then you should chuck out the mikrotik - no need for both of them.

Anyway, why not use the Mikrotik for your VPN endpoints?  There is no reason that I can think of that I would prefer to use a cisco instead of Mikrotik.

Cheers!

... except for the fact that the mikrotik manages a bunch of other subnets that are not relevent to this question, meaning it is not to be discarded.

Cisco is in use because the VPN will be with other Cisco endpoints, and using all Cisco means we can be confident that the VPN will work instead of saying "yeah, they should be compatible, we just need to collect together forum posts and out of date how-tos in order to get the whole thing working with no recourse if it fails"

>> "yeah, they should be compatible, we just need to collect together forum posts and out of date how-tos in order to get the whole thing working with no recourse if it fails"

heheh - yeah, there's one reason to use cisco ;-)  (There are some good Mikrotik consultants aroud tho!)

even so, it still makes sense to use one or the other in that setup - I guess this is only a fraction of what is really connected, but it is hard to dagnose a problem when we see only a small part of the full picture.  See how the replacement gear goes - wouldn't be the first time that I've heard of a cisco router being buggy on arrival (not Mikrotik for that matter!)

Cheers!

Cisco support couldn't figure this one out so they sent out a replacement ASA.  That did not change the symptoms; the ASA simply seems unable to act as a normal router that passes packets through reliably.

We've given up on getting this to work and have just use static NAT to expose the servers on the ASAs outside interface; dropping the static routing entry on the microtik.  It's a bit of hassle, but at least lets us proceed with the network setup.