We have a partner MPLS connection that I am having issues with. Since they are quite a bit larger in size convincing them the issues lies with them is a challenge.
Interestingly they have decided to use public IPs on a dedicated internal network; Again I have no control in that.
There is a shared network space 64.164.0.96/28 used for connectivity. Their requirements dictate that all our connections should originate from 64.164.0.103. I have setup hide NAT, proxy arp, static routes and disabled address spoofing on outgoing the interface to achieve this.
All resources we need access to are in 64.128.0.0/24, 64.131.0.108/30 or 64.144.0.144/30, hence the reason for static routes.
For testing I have ANY/ANY rules to eliminate ACLs as an issue. I am successfully able to connect to basic web pages, but anything that requires token based authentication fails. Working with TAC we have discovered that the connection dies at phase 2, however I am not sure where to take from there.
fw ctl zdebug + drop results in no drops when we grep based on distention IP.
tcpdump shows network flow, but at some point the connection drops.
My only idea at this point to overide the interfaces topology, but I am not sure which would apply.
I am thinking I might set it to undefined since the routes are static and selecting DMZ network as well.
I would welcome any idea and I willing to try anything at this point.
