cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

2513
Views
0
Helpful
4
Replies
Jeffrey Warn
Beginner

Anyconnect VPN user generating ASA-4-419002 errors in log

Consistently I see similar errors like this in my logs. The src address is actually my SCCM server (policy server) and the dst address is a remote VPN user who connects with the AnyConnect client.

%ASA-4-419002: Duplicate TCP SYN from inside:10.2.152.69/2974 to inside:10.2.252.230/139 with different initial sequence number

%ASA-4-419002: Duplicate TCP SYN from inside:10.2.152.69/2973 to inside:10.2.252.230/445 with different initial sequence number

I'd like to try and clean up these errors if possible. Any ideas on what can be done to try and see what the cause of these are?

Thanks

4 REPLIES 4
Parminder Sian
Beginner

Hi Jeffery,

This syslog is indicative of an IP being spoofed, since it is receving a
duplicate TCP SYN packet from another source. A duplicate TCP SYN was
received during the three-way-handshake that has a different initial
sequence number than the SYN that opened the embryonic connection. This
could indicate that SYNs are being spoofed.

The firewall is doing its bit by dropping these duplicate packets and that's
why you are seeing these error messages generated.

I would like to suggest you to troubleshoot the host to determine the reason
why it is sending duplicates or if that is spoofed by other computer coming
from another MAC address.

Regards,
Sian
tom.bakry
Beginner


Hi Jeffrey,

I have the same issue.  We squelched the SCCM server to limit its efforts, just to stop the pain, but, we don't have any answer yet.  Did you discover why SCCM is giving up and moving on to a new TCP sequence number?  I would like to address the root cause on this issue instead of the symptom.  I have just begun my research, so, if I encounter anything useful, I will be sure to post it here.  Unless someone else beats me to it!

Cheers,

Tom

Did you ever find out why the SCCM server was doing this?  I'm having the same issues.

Thanks

Sadly, no, I never received any reply on this thread and my available time to research the issue was limited.  I am certainly interested in learning if anyone discovers the root cause or how to eliminate the trouble.

Tom

Create
Recognize Your Peers
Polls
Which of these topics should we host an event in the Community?

Top Choice: ISE Demo (100%)

Content for Community-Ad