topic TCP Syn timeout on ASA in Network Security

TCP Syn timeout on ASA

mahesh18 — Tue, 12 Mar 2019 02:23:51 GMT

Hi Everyone,

On ASA i allowed Rule to access server on port http.

access-list Net_PC_access_in line 50 extended permit tcp host 192.168.50.12 host 192.168.55.188 eq http

After allowing this rule i can see hit counts on the rule but user is still unable to access the server via http.

Logs from ASA

Built outbound TCP connection 354050568 for Net:192.168.55.188/80 (192.168.55.188/80) to Net_PC_access_in:192.168.50.12/57524 (192.168.50.12/57524)

Teardown TCP connection 354050427 for Net:192.168.55.188/80 to Net_PC_access_in:192.168.50.12/57522 duration 0:00:30 bytes 0 SYN Timeout

where 192.168.55.188 is server ip

192.168.50.12 is user PC.

I check routing on ASA it has Route to PC from interface where server is connected,

What should i check next?

Same server i can access from another subnet.

Regards

Mahesh

TCP Syn timeout on ASA

Jouni Forss — Thu, 08 Aug 2013 19:37:03 GMT

Hi Mahesh,

If we see "Built outbound TCP connection...." log message on the firewall that means the connection has gone through the firewall.

The "Teardown TCP connection..." log message in this case indicates that the connection timed out because the remote end (server) didnt reply to the attempt of the user to form the TCP HTTP connection.

The log messages you posted by the way arent messages from a same connection. You can look at the connection number (or even the source port) and see that they are messages for a different connection.

I would have to say that the most common reason is that there is some routing problem, software firewall or problem with the actual service on the server.

But you say that the server can be accessed from other hosts? Are these hosts from the same network as the user 192.168.50.12?

I am afraid it will be hard to say anything specific about this without seeing the configuration.

- Jouni

Re: TCP Syn timeout on ASA

superation237 — Fri, 29 Aug 2025 19:41:13 GMT

Something else to consider is there might be multiple paths to this server. Does the server have multiple NICs? Are those NICs on the same network or different networks? Different VLANs? I've run into instances where a linux server had old DNS and IPs saved in the nmcli. This also causes SYN timeouts. Something worth investigating.