ASA dropping legitimate returning Internet traffic

Brett Verney — Tue, 12 Mar 2019 02:21:13 GMT

Hi all,

I recently turned on on the 'stateful' feature on our Internet ASA's. It was once disabled completely due to an Asymmetric routing issue that existed within our network. I have managed to turn this back on for all but the subnets that require an Asymmetric routing path.

Now it seems that the ASA's are dropping a significant amount of packets on the OUTSIDE interface for legitimate returning TCP traffiic. At first glance I thought we were under some sort of attack; where the attacker was reversing the source and destination ports; but the source IP addresses are all legitimate well known websites. There does seem to be a ever so slight performance decrease when surfing the web.

I suspect this has something to do with TCP timeout values on either our downstream Proxy (Blue Coat PRoxySG900) or the ASAs but as far as I know they are both set to there defaults.

The proxy is masquerading the client's IP behind it's IP Address (192.168.30.133) and proxy is natted behind the ASA's OUTSIDE Interface IP Address.

My Syslog Server is being flooded with messages like the ones below;

%ASA-4-106100: access-list outside_access_in denied tcp OUTSIDE/74.125.237.134(443) -> INSIDE/192.168.30.133(64440)

%ASA-4-106100: access-list outside_access_in denied tcp OUTSIDE/54.230.72.134(80) -> INSIDE/192.168.30.133(51842)

When I do a 'show asp drop' I see a huge amount of First TCP Packet not SYN ('tcp-not-syn') drops. I'm not sure whether these are being generated on the INSIDE or the OUTSIDE interface.

sh asp drop

Frame drop:

Flow is denied by configured rule (acl-drop) 95989

First TCP packet not SYN (tcp-not-syn) 112941

Bad TCP flags (bad-tcp-flags) 18

TCP data send after FIN (tcp-data-past-fin) 2

TCP failed 3 way handshake (tcp-3whs-failed) 3280

TCP RST/FIN out of order (tcp-rstfin-ooo) 14993

TCP SYNACK on established conn (tcp-synack-ooo) 9

TCP packet SEQ past window (tcp-seq-past-win) 2340

TCP invalid ACK (tcp-invalid-ack) 1

TCP RST/SYN in window (tcp-rst-syn-in-win) 23

TCP packet failed PAWS test (tcp-paws-fail) 2567

FP L2 rule drop (l2_acl) 240223

Dropped pending packets in a closed socket (np-socket-closed) 285

Flow drop:

Inspection failure (inspect-fail) 18

Any assistance would be greatly appreciated!!

Best Regards

Brett Verney

topic ASA dropping legitimate returning Internet traffic in Network Security

ASA dropping legitimate returning Internet traffic