ASA 5510 Message 6-106100 Problems

[Natalia Woloseckyj]

Recently a system within multiple virtual DMZ's under the same firewall (ASA) are producing a message which I would like some clarification to.

Error 6-106100 is Deny TCP (no connection) from xxx/12502 to xxx/32991 flags FIN ACK on interface xxx

I'm assumming that the SYN and SYN ACK are managing to get through as my error logs don't show this, but the FIN ACK's dont?

Could this be caused by a layer 7 timeout issue (application) or could this be the cause of a timeout issue on the ASA?

I'd like to know how best to troubleshoot this, if anyone can assist?

Thanks,

Natalia

[Natalia Woloseckyj]

Can anyone help? I have a feeling that the application that is trying to complete the TCP handshake is sending the final FIN ACK packet on a different session. I know this happens with H323 ansd you use the fixup command on the ASA.

Would a similar thing be needed for this situation, or is this an application layer issue?

Thanks,

Natalia