topic Return traffic being blocked in FTD firewall in Network Security

Return traffic being blocked in FTD firewall

mjrosana02 — Mon, 13 Jan 2025 13:06:33 GMT

Hi all,

Is anyone here also experience this kind of issue on the FTD? we notice that some return traffic being blocked on the FTD.

Thanks for the answer!! 🙂

Re: Return traffic being blocked in FTD firewall

MHM Cisco World — Mon, 13 Jan 2025 12:46:37 GMT

Did you check ""show conn"" to see if there active conn in ftd for retrun traffic

MHM

Re: Return traffic being blocked in FTD firewall

Marvin Rhoads — Mon, 13 Jan 2025 13:51:01 GMT

What indicators are you seeing to lead to believe this is the case?

Have you confirmed the routing is symmetric (return traffic coming via the same interface via which it leaves)?

Re: Return traffic being blocked in FTD firewall

ccieexpert — Tue, 14 Jan 2025 00:53:30 GMT

Please provide logs and if possible packet captures showing this behavior.

Re: Return traffic being blocked in FTD firewall

mjrosana02 — Tue, 14 Jan 2025 01:38:24 GMT

Hi Marvin,

Here is the sample logs, From the existing rule the source is 172.16.x.x network and the destination is 192.168.24.40 on port 8443, there is no issue from this direction. But we are seeing these logs where 192.168.24.40 is communicating back to 172.16.x.x using port 8443 but the destination is the random ports.

Re: Return traffic being blocked in FTD firewall

mjrosana02 — Tue, 14 Jan 2025 01:40:40 GMT

Hello @ccieexpert ,

Good day!
Please refer to my comments above.

Thanks,

Re: Return traffic being blocked in FTD firewall

ccieexpert — Tue, 14 Jan 2025 03:57:39 GMT

that doesnt help as it only shows the reverse packets that are blocked..

first question is there any issue ? or you are just checking why they are happening ?

You should get a syslog of the entire flow from start to finish as shown in the below link.

That will help to see when the CONN was built and when it was teardown.. It is possible that a conn was reset/torn down by the firewall, and then a return packet came after that in the reverse direction, thus my question is it affecting anything..

Please get us the syslog/log for the sourde/destination flow, which allow us more insight.

https://www.lammle.com/post/cisco-firepower-ftd-syslog-messages-and-how-to-see-cisco-ftd-lina-events/

Re: Return traffic being blocked in FTD firewall

Massimo Baschieri — Tue, 14 Jan 2025 05:08:01 GMT

That's return traffic which hits the firewall after the session has already been closed, that is the firewall doesn't find a xlate for those sessions, I suppose this can happen for many reasons, duplicated packets, high latency, network issues, server issues etc..

Nothing to be worried about usually