topic need help with SYN Timoeout message in Network Security

need help with SYN Timoeout message

SOL10 — Mon, 11 Mar 2019 12:51:24 GMT

hi all,

Im trying to establish a connection from a server sitting behind a dmz interface to a linux box on port 4573 (sitting behind the inside interface) the connection is establish and the access list is allowing the packet through but i then get this message:

"Teardown TCP connection 606 for dmz xx.xx.xx.xx/37595 to inside xx.xx.xx.xx/4573 duration 0:00:30 bytes 0 SYN Timeout"

Any ideas why this might be happening?

Regards

Re: need help with SYN Timoeout message

Farrukh Haroon — Thu, 29 May 2008 06:29:11 GMT

This means that the client was unable to establish a three-way handshake (SYN, SYN-ACK and so on) to the server.

I would check the following:

1) Try opening/testing the application from the LAN behind the ASA first, if this is working proceed to the next step.

2) On the internal client that was used for testing in Step (1) check if the service is establishing a connection on the same TCP flow as the one initiated by the client, and there is no dynamic behaviour like in some protocols like FTP, X-Windows etc. This can be done by observing the netstat output using the built-in netstat utility or some third-party package like TcpView.

3) Try troubleshooting with the packet-tracer command on your ASA box

Regards

Farrukh

Re: need help with SYN Timoeout message

SOL10 — Thu, 29 May 2008 07:20:29 GMT

Salaams Farrukh

Thanks for your response. The problem was that the traffic was going through the default gateway of the server concerned(which was the inside intf or another asa) when it should it have been going throuhg the inside intf of the asa to which the remote server is connected (off the dmz). I hope this makes sense as we have a very peculiar setup.

Sol

Re: need help with SYN Timoeout message

Farrukh Haroon — Thu, 29 May 2008 07:23:17 GMT

Wasalam

Great to see you have it working now 🙂

Regards

Farrukh