topic Hi, so you see SYN coming in Network Security

asa 5505 configuration

macazarpros — Fri, 21 Feb 2020 13:26:56 GMT

hey guys

i have a server which accepts traffic on one port inside my network and clients outsides needs to access this server. the nat and accesslist works fine but there is a timeout issue and the connection fails ... note that without the asa client to server directly works fine.. and also note the traffic is encrypted (ssl).. is there any additional provisions i need to configure ? y is it timing out? packet captures show traffic from the outside reaching the inside interface but no response from the inside to the outside....

i have only one access list allowin traffic in from the outside to the server and one nat rule...

advice needed...

thanks

Hi, so you see SYN coming

Pranay Prasoon — Fri, 10 Apr 2015 15:09:18 GMT

Hi,

so you see SYN coming from outside to inside and server is not responding to SYN/ACK?

If this is the case,ASA will wait for 30 seconds and closes the connection if SYN/ACK is not received within this period. In ASA log you will see a syn timeout error message.

Check if server has default route configured. You will need to make sure with captures on server why it is not replying with syn/ack.

thanks pranay..yes im not

macazarpros — Fri, 10 Apr 2015 22:49:30 GMT

thanks pranay..

yes im not good with linux but i 'll look into some comands for debugs...the inside interface and the server is on the same subnet.. the server default route is the defaut route of the subnet.. server XXX.115

inside interface xxx.114 the default route of the server is xxx.1 which is an interface on another asa

hi, So from what I gather

Pranay Prasoon — Fri, 10 Apr 2015 22:58:32 GMT

hi,

So from what I gather

"inside interface xxx.114 the default route of the server is xxx.1 which is an interface on another asa"

It means default route of the server is another ASA. This is not going to work unless you apply TCP statebypass.

ASA is a statefull firewall. It means for TCP IP, it always needs to see two way traffic. If SYN is going through one ASA it should see SYN/ACK back. Similarly if one ASA has not seen syn and sees syn/ack because of asymmetric routing, it is not going to wok.

Either change default route of server from same ASA or configure TCP statebypass(which is not recommended though).

Thanks

thats some good info right

macazarpros — Fri, 10 Apr 2015 23:18:59 GMT

thats some good info right there.. ok i will let you know how it goes on monday.. i dont have access to the test equipment right now to run a transaction.. to clarify.. the asa 5505 is connected to the internet with the config and its inside interface is xxx.114... the outside is nated to the server ip xxx.115.

the server default route is xxx.1 which in interface on a 5520 asa. just so u get it right i will keep you informed on monday

so the default route of the server should be XXX.114?

thansk man.. brilliant u were

macazarpros — Mon, 13 Apr 2015 13:13:19 GMT

thansk man.. brilliant u were right...