ASA SaAB Flags - Incomplete TCP 3-way handshake

[s.nasheet]

Hi,

I am having a problems to SSH  the Server on the DMZ  on Cisco ASA from the Inside interface. 

When I try to connect from Inside to the DMZ ( ssh to the server) I see the  SaAB flag's on the ASA connection table.

Does it mean that Inside interface is initiating the connection by sending the SYN to the server , but server is not replying with the SYN-ACK. 

Is server getting the SNY from the PC to establish SSH connection  or server is not even getting the initial SYN from the inside host  and initial  SYN get lost  in transit due to any other problems such as access rules, routing issues etc.

What does SaAB mean in the connection table on ASA.
 

Your help is appreciated.

Regards

Salman
 

[Karsten Iwen]

You can see the flags description with 

show conn detail

"SaA" means that the ASA has established a connection. All access-control should be fine. It doesn't say that the SYN reached the server, but that is very likely if there is no other filtering device on the way to the server.

"B" stands for outside connection. Do you have a lower security-level on inside than on the DMZ? Or do you see a session that was initiated from the DMZ-server to inside in return? This is quite unusual for your description.