https://community.cisco.com/t5/network-security/deny-tcp-connection/m-p/3908859#M31554 <H3 id="ariaid-title116" class="title topictitle3">106015</H3> <SECTION class="body conbody"> <P class="p"><STRONG class="ph b">Error Message</STRONG> <CODE class="ph codeph"> %<SPAN class="ph">ASA</SPAN>-6-106015: Deny TCP (no connection) from <EM class="ph i">IP_address</EM> /port to <EM class="ph i">IP_address</EM> /port flags tcp_flags on interface interface_name.</CODE></P> <P class="p"><STRONG class="ph b">Explanation</STRONG> The <SPAN class="ph">ASA</SPAN> discarded a TCP packet that has no associated connection in the <SPAN class="ph">ASA</SPAN> connection table. The <SPAN class="ph">ASA</SPAN> looks for a SYN flag in the packet, which indicates a request to establish a new connection. If the SYN flag is not set, and there is no existing connection, the <SPAN class="ph">ASA</SPAN> discards the packet.</P> <P class="p"><STRONG class="ph b">Recommended Action</STRONG> None required unless the <SPAN class="ph">ASA</SPAN> receives a large volume of these invalid TCP packets. If this is the case, trace the packets to the source and determine the reason these packets were sent.</P> </SECTION> Thu, 15 Aug 2019 19:07:03 GMT balaji.bandi 2019-08-15T19:07:03Z https://community.cisco.com/t5/network-security/deny-tcp-connection/m-p/3908847#M31537 <P><STRONG>%ASA-6-106015: Deny TCP (no connection) from xx.xx.xx.xx/sp to yy.yy.yy.yy/dp flags RST on interface inside</STRONG></P><P>Hi, I am getting the above message on syslog.</P><P>Wat cud be the potential issue.</P><P>Is it with my ASA or with the destination server?</P><P>There is an alllow rule in the ASA(inside to any) on 80/443.</P> Thu, 15 Aug 2019 18:47:56 GMT https://community.cisco.com/t5/network-security/deny-tcp-connection/m-p/3908847#M31537 ypawar 2019-08-15T18:47:56Z https://community.cisco.com/t5/network-security/deny-tcp-connection/m-p/3908859#M31554 <H3 id="ariaid-title116" class="title topictitle3">106015</H3> <SECTION class="body conbody"> <P class="p"><STRONG class="ph b">Error Message</STRONG> <CODE class="ph codeph"> %<SPAN class="ph">ASA</SPAN>-6-106015: Deny TCP (no connection) from <EM class="ph i">IP_address</EM> /port to <EM class="ph i">IP_address</EM> /port flags tcp_flags on interface interface_name.</CODE></P> <P class="p"><STRONG class="ph b">Explanation</STRONG> The <SPAN class="ph">ASA</SPAN> discarded a TCP packet that has no associated connection in the <SPAN class="ph">ASA</SPAN> connection table. The <SPAN class="ph">ASA</SPAN> looks for a SYN flag in the packet, which indicates a request to establish a new connection. If the SYN flag is not set, and there is no existing connection, the <SPAN class="ph">ASA</SPAN> discards the packet.</P> <P class="p"><STRONG class="ph b">Recommended Action</STRONG> None required unless the <SPAN class="ph">ASA</SPAN> receives a large volume of these invalid TCP packets. If this is the case, trace the packets to the source and determine the reason these packets were sent.</P> </SECTION> Thu, 15 Aug 2019 19:07:03 GMT https://community.cisco.com/t5/network-security/deny-tcp-connection/m-p/3908859#M31554 balaji.bandi 2019-08-15T19:07:03Z