I'm assuming that there's a switch between the ASA and LB & DC ?
There are few limits with this setup:
1. by default, ASA doesn't allow traffic entering and exiting the same interface. This can be overcome with the
same-security-traffic permit intra-interface
command, which I assume you've already done since they can ping each other.
2. Traffic from the client will reach the LB, and since the LB and DC are on the same connected subnet (vlan 100, 10.1.100.0/24?) the packet will be sent directly from the LB to the DC. However, since the DC only has a
default route
to the ASA, the return packet will be sent to the ASA.
For icmp & udp, this might work, but for protocols such as TCP you'll have issues with the ASA dropping the reply packet as a non-syn packet and no session establishment.
You might be able to work around with using
NAT
on the LB, but that might probably break other things for client to DC communications.
Or you could enable tcp_bypass on the ASA for this traffic. (https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118995-configure-asa-00.html)
If you can't redesign this setup, like for example adding a L3 switch/router to use as your default GW instead of the firewall, or changing the LB to be
"on a stick"
, having a
static route
on the DC might be one of your better options.
You have to consider that whatever solution you choose, that it doesn't make the environment too complex from a troubleshooting perspective.
