ESP traffic through FWSM

Question

HI,
I've built a site-to-site VPNs between a PIX and an ASA with traffic passing through an FWSM.
This is the architecture:
LAN1---PIX--------(dmz interface)FWSM(otuside interface)--------ASA----LAN2
The VPNs go up regurarly but I am experencing some performance issue so I am trying to look into the logs.
In the FWSM log I can see a lots of these entries regarding esp protocol traffic between end point peer:
6|Jan 29 2014|13:07:56|302022|||||Built IP protocol 50 connection 144547910545237602 for outside:x.x.x.x(x.x.x.x) to dmz:y.y.y.y (y.y.y.y)
6|Jan 29 2014|13:07:56|302022|||||Built IP protocol 50 connection 144547910545237601 for dmz:x.x.x.x(x.x.x.x) to outside:y.y.y.y (y.y.y.y)
x.x.x.x and y.y.y.y are the vpn peers ip addresses, but I am suspecting some strange behaviour because I see x.x.x.x an y.y.y.y respectively at the same time on outiside interface and on dmz interface during the build of ip protocol 50 connection.
Do you think it is a normal behaviour or it means that it's a fault?
Pls any suggestion will be very appreciated.
Thanks
angelo

Answer 1

Hi Marcin, thanks for you reply.
Yes I know, I expected two flows for inbound and outbound, it's correct but I don't understand why the FWSM see the same IP incoming both interfaces, dmz and outside. That seems strange. If x.x.x.x is on dmz and y.y.y.y on outside, what does this entry means? :
6|Jan 29 2014|13:07:56|302022|||||Built IP protocol 50 connection 144547910545237602 for outside:x.x.x.x(x.x.x.x) to dmz:y.y.y.y (y.y.y.y).
Hi
angelo