ASA drop upload session

alkabeer80 — Tue, 12 Mar 2019 03:32:12 GMT

Hi, I have asa with policy map below when ever anybody wants to upload large file it drops after some time, since i have multiple services i exclude ip of upload server from access-list and then evrything works normally i want to add and fine tune the below policy map

tcp-map tcp-NORM_Map
check-retransmission
checksum-verification
exceed-mss drop
queue-limit 5 timeout 3
syn-data drop
window-variation drop-connection

policy-map CONNS_policy
class CONNS_Class
set connection conn-max 1500 embryonic-conn-max 200 per-client-max 10 per-client-embryonic-max 15
set connection timeout embryonic 0:00:45 half-closed 0:05:00 tcp 0:10:00 reset dcd 0:00:20 3
set connection advanced-options tcp-NORM_Map

Re: ASA drop upload session

Jouni Forss — Mon, 20 Jan 2014 10:20:12 GMT

Hi,

Have you gathered any firewalls logs or traffic capture data from the dropped connections?

Are you sure that the TCP Map setting of "window-variation drop-connection" is not doing this to your connections? If this setting simply refers to a situation where the window size is changed and because of that dropped I would imagine large transfers will get dropped as I imagine the window size changed during the transfer.

Does the command "show service-policy" provide any information?

- Jouni

topic ASA drop upload session in Network Security

ASA drop upload session

Re: ASA drop upload session