ASA deny TCP no connection

[mahesh18]

Hi Everyone,

User is trying to download some application from cloud and getting error message

Need to know if there is some issue on our end or server is denying the connection

Dec 06 2017 12:57:16: %ASA-6-305011: Built dynamic TCP translation from inside:10.71.123.151/57475 to outside:192.40.147.229/24073
Dec 06 2017 12:57:16: %ASA-6-106015: Deny TCP (no connection) from 10.71.123.151/57475 to 23.74.76.94/443 flags ACK on interface inside
Dec 06 2017 12:57:28: %ASA-6-106100: access-list inside_acl permitted tcp inside/10.71.123.151(57517) -> outside/23.49.100.174(80) hit-cnt 1 first hit [0x3cf7b301, 0x0]
Dec 06 2017 12:57:28: %ASA-6-305011: Built dynamic TCP translation from inside:10.71.123.151/57517 to outside:192.41.148.241/63165
Dec 06 2017 12:57:28: %ASA-6-106015: Deny TCP (no connection) from 10.71.123.151/57517 to 23.49.100.174/80 flags ACK on interface inside
Dec 06 2017 12:57:42: %ASA-6-305012: Teardown dynamic TCP translation from inside:10.71.123.151/57499 to outside:192.40.147.229/42003 duration 0:00:30
Dec 06 2017 12:57:46: %ASA-6-305012: Teardown dynamic TCP translation from inside:10.71.123.151/57431 to outside:192.40.147.229/47734 duration 0:00:30
Dec 06 2017 12:57:52: %ASA-6-305012: Teardown dynamic TCP translation from inside:10.71.123.151/57487 to outside:192.40.147.229/45549 duration 0:00:30
Dec 06 2017 12:57:52: %ASA-6-305012: Teardown dynamic TCP translation from inside:10.71.123.151/57463 to outside:192.40.147.229/37541 duration 0:00:30
Dec 06 2017 12:58:35: %ASA-6-305012: Teardown dynamic TCP translation from inside:10.71.123.151/57514 to outside:192.40.147.229/18306 duration 0:00:30
Dec 06 2017 12:58:35: %ASA-6-305012: Teardown dynamic TCP translation from inside:10.71.123.151/57511 to outside:192.40.147.229/61264 duration 0:00:30
Dec 06 2017 12:58:35: %ASA-6-305012: Teardown dynamic TCP translation from inside:10.71.123.151/57516 to outside:192.40.147.229/28258 duration 0:00:30
Dec 06 2017 12:58:35: %ASA-6-305012: Teardown dynamic TCP translation from inside:10.71.123.151/57515 to outside:192.40.147.229/58400 duration 0:00:30
Dec 06 2017 12:58:35: %ASA-6-305012: Teardown dynamic TCP translation from inside:10.71.123.151/57512 to outside:192.40.147.229/22927 duration 0:00:30
Dec 06 2017 12:58:35: %ASA-6-305012: Teardown dynamic TCP translation from inside:10.71.123.151/57510 to outside:192.40.147.229/18165 duration 0:00:30

where 192.40.147.229 is PAT IP of the user PC.

Regards

Mahesh

[Flavio Miranda · Accepted solution]

Hi @mahesh18

"Deny TCP (no connection) from" is a expected behavior when packet faces asymmetric routing or different firewall context.

 You can take a look here:

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/conns_connlimits.html#wp1089825

-If I helped you somehow, please, rate it as useful.-  

[mahesh18]

Seems we have nat pool of 3 public ip address.

Does it mean that during this connection when IP switch from one public IP to the another public ip that

can cause the remote server to break the connection.

is there any way that i can assign this source IP address to use one public ip in nat pool while going to

any destination address?

Seems this remote application uses many ip addresses as destination.

Thanks fore reply!

Regards

MAhesh

[Flavio Miranda]

Static NAT doesn't work for you? Or you can create a pool with only one IP.

-If I helped you somehow, please, rate it as useful.-

[Dennis Mink · Accepted solution]

The reason the FW blocks it is because your inside client sends/responds an ACK to a the public IP address without the ASA having seen a SYN and SYNACK. in other word the ASA is getting offered traffic that as far as its concerned was never initiated. Like said. this could be cause by asynchornous routing.

run a packet capture and see if you can pick up the stream between the two IP addrresses.