topic snp_drop_none in Network Security

snp_drop_none

lcaruso — Mon, 11 Mar 2019 21:13:54 GMT

Hi,

What does this message on the end of the logged line mean?

Aug 18 2011 13:16:55: %ASA-6-302014: Teardown TCP connection 37247 for outside:192.168.26.125/3618 to inside:172.26.1.5/18082 duration 0:00:00 bytes 0 <snp_drop_none>

ASA 5505 v8.4(2). Thanks.

Also, can someone please confirm that

TCP Reset-I

TCP Reset-O

means that the connection was reset from the Inside host and Outside host, respectively?

Thanks.

snp_drop_none

varrao — Fri, 19 Aug 2011 02:37:00 GMT

Well the syslog guide as well does not indicate any such syslog, you might be hitting:

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCta83553

But this bug was supposed to be fixed in 8.3, so not really sure about the reason, I suggest if the logs that you get are huge in number open a TAC case for it.

THe TCP-Reset-I mean that the reset was from the host on the higher security level

TCP-Reset-O means the reset came from the host on the lower security level.

Its not always isnide, outside, the I and O are just reference points, they do not mean inside, outside.

It could be inside and dmz as well, depends upon the security levels.

Thanks,

Varun

snp_drop_none

lcaruso — Fri, 19 Aug 2011 12:47:22 GMT

Thanks much.