ASA - duplicate TCP SYN syslog 419002

[zrunner626]

I am seeing a large number of duplicate TCP SYN errors on our ASA and FTD. The majority are for the VPN subnet to a Private IP such as 10.0.0.x that does not exist on our network. Seems to me that it could be the local subnet of the VPN client that is getting routed through the VPN possibly... We do split tunneling and send the private IPs toward the ASA and all other straight to the internet.

I tried creating a null route for the 10.0.0.x subnet but we continue to see the error. I came across one article that suggested turning off TCP Randomization for the VPN subnet. Assuming this would be safe since it's tunneled traffic and not NATed traffic.

Would welcome any other suggestions or thoughts.

[Marius Gunnerud]

How did you try to exclude the local networks?  Did you add a deny 0.0.0.0/32 statement in the split-tunnel ACL?  If not, do this and make sure that "allow local LAN access" is checked in the AnyConnect VPN client.

[zrunner626]

Hi Marius, Thanks for the response. I was blocking the local networks I was seeing from the inside interface of the ASA. I don't think the 0.0.0.0/32 would work as we are sending all 10.0.0.0/8 traffic through VPN so even if 10.0.0.x/24 is unused for example the traffic is still getting sent thorugh the tunnel. After confirming that the syslog was indeed a message displayed after the packet was dropped I ended up just disabling logging for that syslog ID.

Thanks

[Marius Gunnerud]

OK fair enough.  Just so you know, 0.0.0.0/32 specifies the local network that the AnyConnect client is connected to so by denying this in your split tunnel ACL all traffic to the local LAN will not pass through the AnyConnect tunnel.  That being said, if the local LAN where an AnyConnect client is connected to has an overlapping subnet with your office, this office network would not be available to that AnyConnect client.