this issue is common in the asa, it can be caused by assymetric routing. The asa is a stateful firewall - stateful inspection works is that when i.e. a TCP connection is established an entry of this connection is entered to a "state table" All segments flowing both ways on the connection after that are accepted based on this state table information instead of the firewall acl's
The other peer might not have the same information in its state table, and cannot see where the tcp connection originated from, so it blocks the tcp connection hence the error message Deny TCP (no connection) from 172.10.100.100/9100 to 192.168.2.4/2172 flags SYN ACK on interface outside
check your static routes for this network. As grape soda indicates, try pinging as he suggested if no reply on the pings, check default gateway on print server.
you could add static route in access data switches if they are managed, or try a static route on the print server
Worst case scenario to solve routing problems on asa would be to use link state routing protocol such as ospf. works great on the asa to advertise all routes and will solve assynmetric routing issues. While I am not a great fan of having firewalls do routing, as it does add some cpu overhead, sometimes you need to bend the rules to fit your situation. Static routes are the best since they have the lowest metric and use no cpu overhead
Main Topics
Browse All Topics
by: Grape_SodaPosted on 2009-10-22 at 09:12:40ID: 25635864
Try Pinging from the printer to the print server and let me know.