ASA code 9.7

[Dieselboy]

 

Just another FYI - seems like "TCP state bypass" might have some issues.. My VTI VPN is working but guys in Sri Lanka are getting weird timeouts when trying to connect to stuff. They keep trying and it works. Issue is random, seemed like TCP port exhaustion. Looks like an embryonic timeout is coming into play even though I've set tcp state bypass for traffic flowing through the ASA which matches my site to site subnets.
I have a TAC case open to confirm my tcp state bypass should also mean the embryonic timeout does not come into play. I now have this timeout set to unlimited on the service policy and the issue has gone away (at the moment, but it's barely been 24 hours). I'm still deciding on whether to re-produce the problem to gather the inspections / captures to dig deep.

[deanwebb]

Soooooo... if I hear you correctly... you're saying.... DON'T upgrade to 9.7?

<- Your TAC guy will make this face

<- or this one

when you call in with that call that starts with "I just upgraded to 9.7, and..."