topic Re: IPSEC peers (FP and ASA) send TCP RST to the endpoints in Network Security

IPSEC peers (FP and ASA) send TCP RST to the endpoints

Micccc4 — Wed, 23 Nov 2022 15:31:56 GMT

Hi Everyone,

we have an IPSEC tunnel between FP2110 and ASA firewall.

Tunnel is stable and operational but every hour, at the same time, peers (firewalls) at both ends send TCP RST packet to the endpoints at their side that are having active session via IPSEC tunnel. That breaks the session..

Has anyone experienced something similar?

SA Lifetime in IPSEC setup is set to 8 hours at both ends and flow is allowed on ACLs at both firewalls.

Thanks in advance for looking at it 🙂

TCP RST from FP sent to endpoints at his location:

TCP RST from ASA sent to endpoints at his location:

Re: IPSEC peers (FP and ASA) send TCP RST to the endpoints

buffkata — Wed, 23 Nov 2022 16:09:03 GMT

It looks like the TCP session is reset by the client not by the VPN peer. Is your tunnel rebuild after the reset ?

Re: IPSEC peers (FP and ASA) send TCP RST to the endpoints

Micccc4 — Wed, 23 Nov 2022 20:15:09 GMT

Hi @buffkata - thanks for commenting. Well, this was my first thought as well - that is how it looks based on the SRC IP address. However, RST packet that is received by the end point at one side of the tunnel is not captured on the other, 'source' side. So, where is it coming from. and then I came across this video here:

(and tunnel itself is stable when this reset takes place)

https://www.youtube.com/watch?v=t5OJephyw8I