topic Mahesh,Glad you got it in Network Security

106021: Deny TCP reverse path check from

mahesh18 — Tue, 12 Mar 2019 06:16:19 GMT

Hi everyone,

PC traffic ------Switch ----X int ASA-----y int ----server 172.31.50.55

I see below log when user try to access the server

106021: Deny TCP reverse path check from 192.168.100.25 to 172.31.50.55 on interface X

Does it mean that ASA did not pass the traffic from interface X to Y as there is no return path to subnet 192.168.100.25?

Regards

Mahesh

Mahesh,It could be routing

Marvin Rhoads — Thu, 16 Jul 2015 03:52:00 GMT

Mahesh,

It could be routing but the most common cause is asymmetric NAT.

See what a packet-tracer tells you.

Hi Marvin, For packet tracer

mahesh18 — Thu, 16 Jul 2015 04:48:57 GMT

Hi Marvin,

For packet tracer i can run from interface y to x to check the return traffic right?

Regards

MAhesh

Mahesh,Per the syntax Igor

Marvin Rhoads — Thu, 16 Jul 2015 13:54:43 GMT

Mahesh,

Per the syntax Igor posted, always run it to simulate the actual traffic as initiated from the end user (192.168.100.25 in your case).

The utility will use its built in logic to check the reverse path automatically.

Example: packet-tracer input

Igor Mordiuk — Thu, 16 Jul 2015 14:15:35 GMT

Example:

packet-tracer input X_int_name tcp 192.168.100.25 PCSource_port 172.31.50.55 dst_port detailed

issue was with routing.

mahesh18 — Thu, 16 Jul 2015 19:55:56 GMT

issue was with routing.

Mahesh,Glad you got it

Marvin Rhoads — Fri, 17 Jul 2015 02:35:25 GMT

Mahesh,

Glad you got it resolved, thank for the ratings.

packet-tracer is your friend on the ASA. After seeing the TAC run it time and again during my time learning the platform, I decided they might know a thing or two and put it on my short list of go-to tools as well.