Hi @rcaduser You have a special routing/firewall desgin here 😛 and I have some additional questions: Do you have a zone protection profile applied to the zones of e1/12.2 and e1/12.3? If yes, which protections are enabled? When you did the packet capture on the firewall, did you enable "Pre parse match"? Right now my assumption is, that the reply traffic is an IP spoofing attack for the firewall. Because whem the firewall sends an LDAP query out of vlan 2 towards the AD, the reply traffic obviously gets also back to the interface e1/12.2. But for this reply packet the source IP is the AD server IP - an IP that belongs to vlan 3 where the firewall is also directly connected. Because of that the firewall expects traffic from AD on e1/12.3 and not on e1/12.2 so it drops the packets arriving there. In your final test when you changed the service route you have exactly the opposite that when connecting to the sun LDAP the source is e1/12.3 and then the firewall receives a reply from a server in vlan 2 that it does not expect on e1/12.3 so it dropps it. So solve this you could configure IP based service routes instead of feature based. Or: does the firewall really need interfaces in noth vlans when the routing is done on the core switch? In this case I would use a transport network between the firewall and the core switch instead of connecting the firewall to both vlans, but probably there are other reasons why you configured it this way.
... View more
