topic Duplicate TCP SYN in Network Security

Duplicate TCP SYN

Spagsterj — Tue, 12 Mar 2019 00:36:39 GMT

Hello, I'm having an issue allowing legitimate network traffic out. My ASA logs are filling up with:

%ASA-4-419002: Duplicate TCP SYN from inside:192.168.1.41/xxxx to outside:172.16.1.215/xxxx with different initial sequence number

The traffic is known and good traffic. TCP-bypass did not appear to resolve this issue.

Are there any other workarounds or suggestions?

Thanks in advance,

James

Duplicate TCP SYN

Jouni Forss — Wed, 12 Dec 2012 22:46:53 GMT

Hi,

Is the destination address some VPN Client Pool?

Can you share your ASA configuration also?

- Jouni

Duplicate TCP SYN

Spagsterj — Thu, 13 Dec 2012 01:05:19 GMT

No, the destination address is a public server. However, the client 192.168.1.41 is contacting 172.16.1.215 using a VPN client. Communication between these two hosts pairs is wide open.

Duplicate TCP SYN

Jouni Forss — Thu, 13 Dec 2012 10:30:31 GMT

Hi,

Are you saying that 192.168.1.41 is a VPN Client user IP and 172.16.1.215 IP is some server?

If this is the case then its pretty wierd considering the log messages states that the 192.168.1.41 is behind "inside" and 172.16.1.215 is behind "outside"

Or are we perhaps talking about a connection attempt through a L2L VPN and not Client VPN? I mean a connection between 2 LANs connected by Site to Site VPN.

- Jouni

Duplicate TCP SYN

Spagsterj — Thu, 13 Dec 2012 13:53:01 GMT

Yes, 192.168.1.41 is the client/PC on the inside and 172.16.1.215 is a server on another network, which is accessable via the outside interface. 192.168.1.41 is attempting to connect using it's VPN client to 172.16.1.215.

The VPN client or server is not Cisco - I did get it to work by writing a tcp-bypass policy, however I still beleive it should work without having to write the tcp-bypass policy.

Thanks!

Duplicate TCP SYN

Julio Carvajal — Thu, 13 Dec 2012 17:05:24 GMT

Hello,

Perfom a capture on the inside interface of the ASA matching this traffic, then create one to check the ASP drops...

capture capin interface inside match tcp host 192.168.1.41 host 172.16.1.215

cap asp type asp-drop all circular-buffer

Then without the TCP-state-bypass in place attemtp to connect ( just one connection) and share the following

show cap capin

show cap asp | include 172.16.1.215

Regards

Duplicate TCP SYN

Spagsterj — Fri, 14 Dec 2012 15:57:00 GMT

Here is the packet capture. TCP-bypass was turned-off.

ASA(config)# show cap capin

3 packets captured

1: 10:45:36.372569 802.1Q vlan#10 P0 192.168.1.41.1194 > 172.16.1.215.1194: S 2130111956:2130111956(0) win 65535

2: 10:45:39.372402 802.1Q vlan#10 P0 192.168.1.41.1194 > 172.16.1.215.1194: S 2130111956:2130111956(0) win 65535

3: 10:45:42.572297 802.1Q vlan#10 P0 192.168.1.41.1194 > 172.16.1.215.1194: S 2130111956:2130111956(0) win 65535

3 packets shown

ASA(config)# show cap asp | include 172.16.1.215

Duplicate TCP SYN

Julio Carvajal — Fri, 14 Dec 2012 17:20:15 GMT

Hello,

In this case we only see the SYN packets, no SYN-ACK..

The ASA does not seem to be dropping it as you do not have those packets on the ASP capture...

Is there a way you could run a capture on the server side ( if there is an ASA run it there) or on the server itself to make sure he is receiving the SYN packets,

Regards