Adress Spoofing with Always On VPN RAS Server

[Dende]

Hi,

we have set up a RAS server in our DMZ network (192.168.76.0/24). Behind this RAS server is the RAS VPN network with its own IP range 192.168.73.0/24. A route to this network was set up on the firewall. In the logs, however, I always see address spoofing messages that traffic from the internal network 10.90.90.0/24 is said to come from the DMZ Network nic2, but this is not true. I also excluded the IP from address spoofing in the DMZ network.
The address spoofing message only comes when the internal Network (for example DC Server) accesses to the RAS Client IPs 192.168.73.x. A Firewall rule permit the Access!

The access still works for a while, although the messages for address spoofing is coming. After a time it blocks every access. If I restart the RAS Server it works again!?!? I don't understand?

Do I have to exclude the VPN network anywhere else?

regards,
Dende

[Bob_Zimmerman]

That's almost certain to be a routing loop. Run an fw monitor when you see the problem. I bet you will see a SYN pass through the firewall, then the same SYN hit the firewall on the interface it just left.

[Dende]

I can't see any problems!?

[vs_0][fw_1] eth2:i[60]: 192.168.73.24 -> 10.90.90.13 (ICMP) len=60 id=5966
ICMP: type=8 code=0 echo request id=1 seq=97
[vs_0][fw_1] eth2:I[60]: 192.168.73.24 -> 10.90.90.13 (ICMP) len=60 id=5966
ICMP: type=8 code=0 echo request id=1 seq=97
[vs_0][fw_1] eth3: o[60]: 192.168.73.24 -> 10.90.90.13 (ICMP) len=60 id=5966
ICMP: type=8 code=0 echo request id=1 seq=97
[vs_0][fw_1] eth3:O[60]: 192.168.73.24 -> 10.90.90.13 (ICMP) len=60 id=5966
ICMP: type=8 code=0 echo request id=1 seq=97
[vs_0][fw_1] eth3:i[60]: 10.90.90.13 -> 192.168.73.24 (ICMP) len=60 id=14220
ICMP: type=0 code=0 echo reply id=1 seq=97
[vs_0][fw_1] eth3:I[60]: 10.90.90.13 -> 192.168.73.24 (ICMP) len=60 id=14220
ICMP: type=0 code=0 echo reply id=1 seq=97
[vs_0][fw_1] eth2: o[60]: 10.90.90.13 -> 192.168.73.24 (ICMP) len=60 id=14220
ICMP: type=0 code=0 echo reply id=1 seq=97
[vs_0][fw_1] eth2:O[60]: 10.90.90.13 -> 192.168.73.24 (ICMP) len=60 id=14220
ICMP: type=0 code=0 echo reply id=1 seq=97