ASA-4-41900

aeryilmaz · ‎09-01-2011

Hi all,

This is one that's come up in the Community before, but none seem to fit my scenario.

I'm getting these errors at regular intervals. The source IPs are from my pair of F5 BigIP LTMs that are directly connected off the DMZ interface.

Sep 01 2011 17:32:04: %ASA-4-419002: Duplicate TCP SYN from dmz:172.250.50.9/57400 to inside:172.250.10.86/80 with different initial sequence number

Sep 01 2011 17:32:43: %ASA-4-419002: Duplicate TCP SYN from dmz:172.250.50.8/46246 to inside:172.250.30.21/25 with different initial sequence number

I am seeing input errors on the switch port connecting the ASA DMZ interface:

764 input errors, 1 CRC, 0 frame, 0 overrun, 0 ignored

I am running EIGRP on the ASA:

router eigrp 10

network 172.250.50.0 255.255.254.0

network 172.250.0.0 255.255.0.0

Any troubleshooting suggestions?

Thanks!

Maykol Rojas · ‎09-01-2011

Hi,

I would first take a look at the source if it is actually sending duplicate TCP SYN's, the ASA will actually drop them since it is just a duplicate packet.

Take a capture or a tcpdump on the source and check if two SYNs are leaving towards the ASA interface.

Mike

aeryilmaz · ‎09-02-2011

Thanks, Mike. Will do. Good idea.

dominic.caron · ‎10-31-2011

How did this turn out? Him having the exact same issue.

aeryilmaz · ‎10-31-2011

I have not yet got to the bottom of this. I ran captures watching traffic from my BigiP and did not see duplicate sequence numbers. So, the alerts appear to be cosmetic, but I have not yet proved that.

Are you running F5 LTMs as well? Those load balancers have a "one-connect" feature that I suspect may be related.

dominic.caron · ‎10-31-2011

It's not the oneconnect profile, it's disable on my virtual server.

Maykol Rojas · ‎10-31-2011

All,

If you take a capture on the incoming interface of the firewall and yet you see the duplicate packets there, it would be a good idea to take a look at a packet capture to see the source mac-addresses and check if they are different. Another good thing to do is to check if the switch is seeing the same mac-address (in this case the ASA one) on two different ports, as the switch will forward the packet on both switchports and hence the ASA will receive it twice.

Just to narrow down what the problem is.

Thanks.

Mike

dominic.caron · ‎11-11-2011

Finaly....

The BigIP is re-using source ports too fast in it's default configuration(15-20 ms after initial FIN). You need to time the half-close timeout value in the server, asa and BigIP to the same value.