sync timeout in 00:00:30 bytes 0

jhsdc-it — Thu, 11 Jun 2020 19:03:26 GMT

I have ASA 5585SSP40

one interface naming external and i have interface having zone116

ip address 10.26.X.X from interface external want to connect server 10.92.x.x but unable to connect and when i see in the logs it is showing like this

Deny TCP (no connection ) from 10.92.Y.Y/22 to 10.26.X.X/56899 flags SYN ACK on interface zone116

teardown TCP connection for x@ interface:10.26.X.X/56899 to zone 116:10.92.Y.Y/22 duration 00:00:30 bytes 0 sync Timeout

Built inbound TCP connection from external 10.26.X.X/56900 to zone116 10.92.Y.Y/22

Re: sync timeout in 00:00:30 bytes 0

Sheraz.Salim — Thu, 11 Jun 2020 20:42:08 GMT

Built inbound TCP connection from external 10.26.X.X/56900 to zone116 10.92.Y.Y/22 means the connection has gone through the firewall. by system default the time out for tcp is

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02

teardown TCP connection log message in this case indicates that the connection timed out because the remote end didnt reply to the attempt of the user to form the TCP 22/ssh connection.

Deny TCP (no connection ) from 10.92.Y.Y/22 to 10.26.X.X/56899 flags SYN ACK on interface zone116

So for TCP 3 way handshake, it should be as follows:

SYN: Outside --> Inside

SYN-ACK: Inside --> Outside

ACK: Outside --> Inside

From the logs, here is instead what happens:

SYN: Outside --> Inside

SYN-ACK: Outside --> Inside

Hence the ASA is dropping the connection. The SYN-ACK packet is actually received on the outside interface instead of the inside interface as it should be.

Here is how it goes:

- ASA receives SYN, and place that in the connection table.

- If the ASA does not receive the SYN-ACK packets within 30 seconds, it will clear that particular connection.

- So if the SYN-ACK packet arrives at the ASA after the default timeout of 30 seconds, you will receive that error message of no TCP connection found.

By default, the TCP incomplete timeout is 30 seconds.

make sure is the nat rule/acl for the dmz server and the routing in place?

hope this help you.

topic Re: sync timeout in 00:00:30 bytes 0 in Network Security

sync timeout in 00:00:30 bytes 0

Re: sync timeout in 00:00:30 bytes 0