Trying to migrate to routed mode

Question

We have multiples css11k configured as bridge mode.
The firewall has direct connection to all DMZ (one vlan per DMZ) and it is the default gateway for all servers. The CSS11K is connected to all DMZs and using the group NAT to relay traffic to the real servers. The firewall does NAT for public to private VIP.
We are trying to migrate to routed mode so the servers can capture true source IP addresses, reduce the number of default routes in the CSS and remove the public VIP NATed in the firewall (to setup content rule VIP using the public ip address).
A new test DMZ is setup and it is connected by CSS and the real HTTPs servers. A test ip address is
configured at the firewall without NAT and the firewall is configured to route the incoming traffic to the CSS through one of the existing DMZ. The content rule of the CSS is configured using the test public ip address. I can see traffic in/out through the two sniffers I setup (between f/w and CSS, and CSS and real server). Most of time, we cannot get page displayed. The firewall log showed all traffic in/out through the correct interface. The sniffer showed data retransmission, tcp rest, tcp out of order .....
Any suggestion.
p.s. The ssl certificate is associated with the public ip address. The server is working fine if we connect the firewall directly to the new test DMZ and have firewall does the server IP NAT.

Answer 1

here is section of the cfg (modified ip address and name):
############# using network 10.10.20.0/255.255.255.0 to route 100.1.1.1 traffic to CSS11K
ip route 0.0.0.0 0.0.0.0 10.10.20.1
ip route 0.0.0.0 0.0.0.0 10.10.10.1
!************************* INTERFACE *************************
interface 1/1
trunk
redundancy-phy
vlan 10
vlan 20
vlan 30
interface 2/1
trunk
vlan 10
vlan 20
vlan 30
interface 3/1
bridge vlan 999
phy 100Mbits-FD
!************************** CIRCUIT **************************
circuit VLAN10
redundancy
ip address 10.10.10.254 255.255.255.0
no redirects
circuit VLAN20
redundancy
ip address 10.10.20.254 255.255.255.0
no redirects
circuit VLAN30
redundancy
ip address 10.10.30.254 255.255.255.0
no redirects
circuit VLAN999
description "Box-to-Box Redundancy VLAN"
ip address 10.0.0.1 255.255.255.252
redundancy-protocol
!************************** SERVICE **************************
service VLAN10-SERVER-1
ip address 10.10.10.125
protocol tcp
port 80
domain test.vlan10.com
keepalive type tcp
keepalive port 80
active
service VLAN10-SERVER-2
ip address 10.10.10.126
protocol tcp
port 80
domain test.vlan10.com
keepalive type tcp
keepalive port 80
active
service VLAN20-SERVER-1
ip address 10.10.20.125
protocol tcp
port 80
domain test.vlan20.com
keepalive type tcp
keepalive port 80
active
service VLAN20-SERVER-2
ip address 10.10.20.126
protocol tcp
port 80
domain test.vlan20.com
keepalive type tcp
keepalive port 80
active
service ROUTED-SERVER
protocol tcp
ip address 10.10.30.18
no cache-bypass
keepalive type tcp
keepalive port 443
keepalive frequency 60
port 443
domain ROUTED-SERVER.com
active
!*************************** OWNER ***************************
owner vlan10
content vlan10.com
dnsbalance roundrobin
vip address 10.10.10.100
protocol tcp
port 80
balance aca
add service VLAN10-SERVER-1
add service VLAN10-SERVER-2
advanced-balance sticky-srcip
active
owner vlan20
content vlan20.com
vip address 10.10.20.100
protocol tcp
port 443
add service VLAN20-SERVER-1
add service VLAN20-SERVER-2
advanced-balance sticky-srcip
active
owner routed-segment
content routed-server.com
vip address 100.1.1.1
balance aca
port 443
protocol tcp
dnsbalance roundrobin
add service ROUTE-SERVER
active
!*************************** GROUP ***************************
group group.nat.vlan10
portmap number-of-ports 14304
vip address 10.10.10.100
add destination service VLAN10-SERVER-1
add destination service VLAN10-SERVER-2
active
group group.nat.vlan20
portmap number-of-ports 14304
vip address 10.10.20.100
add destination service VLAN20-SERVER-1
add destination service VLAN20-SERVER-2
active