topic VDI traafic issues in Network Security

VDI traafic issues

prashantrecon — Tue, 12 Mar 2019 02:04:53 GMT

Hi All,

we are facing problem while accessing virtual machine with citrix clients.

It works properly when we disable the IPS.

As soon as IPS is enabled it gets hanged .As checked with captures we found the packet were out of order.

So we increased our que limit to 250 on firewaal for that traafic..Eventhough it is not working .

Is there any particular signatures we need to disable for this?.

VDI traafic issues

Julio Carvajal — Sat, 29 Jun 2013 16:00:39 GMT

Hello Prashant kumar,

Can you go to the IPS and check the event store to see if while you attempt to connect a signature was triggered,

show statistics virtual-sensor

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.

VDI traafic issues

prashantrecon — Sun, 30 Jun 2013 07:08:41 GMT

Hi ,

Thanks for reply

i am checking with cisco IME real time log viewer and i am not seeing any alert for that source ip.

Regards,

Prashant

VDI traafic issues

Julio Carvajal — Sun, 30 Jun 2013 07:12:56 GMT

Hello Prashant,

Okey, so no alerts,

Do you see any hits on the show command I gave u (you should see all the signatures being triggered and the amount of times they have been triggered).

Also OOO are not expected on a network with a FW or IPS due to how the normalizer engine works (In this case the firewall will gather all the OOO packets and place them into a queue until all packets reach the box and then they will be ordered, aftewards they will be send to the IPS {Latency in place here}, then the IPS normalizer is really strict with TCP flows so the same will happens here)

How many OOO are you seeing?

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.

VDI traafic issues

prashantrecon — Tue, 02 Jul 2013 04:07:32 GMT

HI,

Below is the output of sh asp drop

asa# sh asp drop

Frame drop:

Invalid TCP Length (invalid-tcp-hdr-length) 2739

Invalid UDP Length (invalid-udp-length) 17566

No valid adjacency (no-adjacency) 653905

No route to host (no-route) 345270

Reverse-path verify failed (rpf-violated) 388748876

Flow is denied by configured rule (acl-drop) 36060607

Flow denied due to resource limitation (unable-to-create-flow) 6791470

Invalid SPI (np-sp-invalid-spi) 12834

NAT-T keepalive message (natt-keepalive) 2554723

First TCP packet not SYN (tcp-not-syn) 17005256

Bad TCP flags (bad-tcp-flags) 225404

TCP data send after FIN (tcp-data-past-fin) 401

TCP failed 3 way handshake (tcp-3whs-failed) 1195674

TCP RST/FIN out of order (tcp-rstfin-ooo) 9044823

TCP SEQ in SYN/SYNACK invalid (tcp-seq-syn-diff) 139054

TCP ACK in SYNACK invalid (tcp-ack-syn-diff) 2

TCP SYNACK on established conn (tcp-synack-ooo) 49477

TCP packet SEQ past window (tcp-seq-past-win) 1591164

TCP invalid ACK (tcp-invalid-ack) 81679

TCP replicated flow pak drop (tcp-fo-drop) 1729

TCP ACK in 3 way handshake invalid (tcp-discarded-ooo) 2235

TCP Out-of-Order packet buffer full (tcp-buffer-full) 5059051

TCP global Out-of-Order packet buffer full (tcp-global-buffer-full) 20

TCP Out-of-Order packet buffer timeout (tcp-buffer-timeout) 4861218

TCP RST/SYN in window (tcp-rst-syn-in-win) 380728

TCP dup of packet in Out-of-Order queue (tcp-dup-in-queue) 35381750

TCP packet failed PAWS test (tcp-paws-fail) 429340

IPSEC tunnel is down (ipsec-tun-down) 10495

Early security checks failed (security-failed) 108781

Slowpath security checks failed (sp-security-failed) 139185

IP option drop (invalid-ip-option) 11991

Expired flow (flow-expired) 31251

ICMP Inspect seq num not matched (inspect-icmp-seq-num-not-matched) 49

ICMP Error Inspect no existing conn (inspect-icmp-error-no-existing-conn) 22232

DNS Inspect invalid packet (inspect-dns-invalid-pak) 30

DNS Inspect invalid domain label (inspect-dns-invalid-domain-label) 191

DNS Inspect packet too long (inspect-dns-pak-too-long) 993166

DNS Inspect id not matched (inspect-dns-id-not-matched) 114282

IPS Module requested drop (ips-request) 658857

FP L2 rule drop (l2_acl) 108072704

Interface is down (interface-down) 24066

Dropped pending packets in a closed socket (np-socket-closed) 14775

Last clearing: Never

Flow drop:

Flow is denied by access rule (acl-drop) 67336

Flow terminated by IPS (ips-request) 11290

NAT failed (nat-failed) 52090

NAT reverse path failed (nat-rpf-failed) 41358

Tunnel being brought up or torn down (tunnel-pending) 2

Need to start IKE negotiation (need-ike) 47678

Inspection failure (inspect-fail) 685750

SSL received close alert (ssl-received-close-alert) 40

IPSec inner policy mismatch failure (ipsec-selector-failure) 126

i am having some doubt on ISP . i have changed the isp to Secondary and from now performace is Stable.

Is it possible the even i am not getting any Event on Cisco Ime ,IPS could casue such problem ?

Regards,

Prashant

VDI traafic issues

Julio Carvajal — Tue, 02 Jul 2013 04:28:18 GMT

Hello Prashant,

There is a huge amount of drops due to OOO packets in our network,

Before the ASA can send the traffic to the IPS it must be normalized so yes, if traffic cant be normalized it will drop,

Glad to see is good at the moment,

Any other question you have?

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.

VDI traafic issues

prashantrecon — Tue, 02 Jul 2013 08:10:02 GMT

I am not able to conclude wheter the problem was solved by changing the isp or shuting down IPS.

As if now the ips is on. Thus the problem occur due to isp also?

VDI traafic issues

Julio Carvajal — Tue, 02 Jul 2013 17:00:52 GMT

Exactly,

The traffic patterns that you were receiving from the IPS was harming the network (traffic ooo) which causes several performance problems,

Regards

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.