topic ASA 9.1(2) in Network Security

ASA 9.1(2)

Tuyen Nguyen — Tue, 12 Mar 2019 01:54:32 GMT

Greetings

We encountered issues and wondering if anybody had the same or similar issues with this code.

We are sending print jobs utilizing TCP 1526/1527 ports from unix to unix server. But for some reason when larger files are being transferred this crashes the unix server or files become corrupted. In between we have Cisco ASA 5520 firewall running v 9.1(2). We tried tweaking the TCP settings and loosening ACL, and no inspection drop but to no success.

When taking ASA out the equation, everything works.

- 05:44 - Email from the business:

Good morning,

I need an update on where we are to resolving this issue. This has a high

impact to my team as vendors rely on the information being printed as

supporting documents for their payments. If we do not provide these

documents, vendors can deny these deductions given we have not provided

the paperwork to substantiate the deduction. This affects approximately

4000 vendors.

Samantha Brinker

Manager, Expense Payment Operations

ASA 9.1(2)

Julio Carvajal — Fri, 07 Jun 2013 16:58:59 GMT

Hello Tuyen,

What do the logs on the ASA show?

Is there a way that you could do a capture between the ASA interfaces and an ASP capture,

Let me know,

Regards,

Hey remember to rate all of the helpful posts, as important as a thanks (keep us motivated)

ASA 9.1(2)

Tuyen Nguyen — Fri, 07 Jun 2013 18:19:31 GMT

Thanks for responding.

Nothing abnormal in the logs other then FIN's

Deny TCP (no connection) from 192.168.65.11/1526 to 42.108.51.10/32915 flags FIN ACK

Bunch of TCP DUP ACK for re-transmission in the captures but that looks normal.

ASA 9.1(2)

Julio Carvajal — Fri, 07 Jun 2013 19:12:09 GMT

Hello Tuyen,

Without seeing the captures I can't help that much,

Have you set the TCP state-bypass feature for this traffic?

Regards,

Hey remember to rate all of the posts, this keeps us motivated to keep replying.

ASA 9.1(2)

Tuyen Nguyen — Wed, 19 Jun 2013 19:23:28 GMT

Thanks for your assistance the TCP state-bypass feature worked beautifully.