Investigate new TCP connections from specific port (HTTPS)

Eric Snijders — Fri, 21 Feb 2020 16:59:54 GMT

Hi all,

I think i have a very simple question. We have a server making a lot of HTTPS connections to different IP's. We have a a specific rule in our ACL for this traffic. When building the firewall rules, i still noticed a lot of hits on the permit ip any-any rule so i digged deeper.

I found that this same server was building outbound TCP connections, but with the source port of tcp/443. Like this:

2019-04-02 08:40:36	Local6.Notice	192.168.20.71	Apr 02 2019 08:41:07: %ASA-5-106100: access-list LSPXSG4_access_in permitted tcp LSPXSG4/LSPAPPAMD211(443) -> Zorgnet/172.24.140.201(14728) hit-cnt 1 first hit [0x221dee80, 0x00000000]

Ofcourse, i can make a ACL entry that permits this traffic based on the Source Service, but i would like to know/investigate why this is happening.
Am i right by saying that the above entry is a new TCP Connection with Source Port of 443?
I'm a bit clueless on where to start troubleshooting/capturing. Obviously it would be best to start at the source (the server) but if i would want to capture traffic there, what should i look at? Source Port 443 and some kind of TCP Syn filter or anything?

Edit:
I did a Wireshark capture on the source (LSPAPPAMD211). I waited for the access-list to get a new hit with tcp/443 as the source port. I checked that TCP connection in WireShark based on the destination port (random port number). I looked at it but i didn't see anything weird.

If anyone has a idea why this traffic is generating hits on the any-any rule that would be great. I want to get rid of the any-any rule.

Re: Investigate new TCP connections from specific port (HTTPS)

Sheraz.Salim — Tue, 02 Apr 2019 14:59:10 GMT

hmm... here some of the tips you can you to see what is happening.

show conn 192.168.20.71

show local-host 192.168.20.71 or show local-host 192.168.20.71 brief

show service-policy flow tcp host 192.168.20.71 host 8.8.8.8

topic Re: Investigate new TCP connections from specific port (HTTPS) in Network Security

Investigate new TCP connections from specific port (HTTPS)

Re: Investigate new TCP connections from specific port (HTTPS)