ASA Teardown TCP Connection for outside to DMZ

[maamon.albattah]

I have the problem that i can not connect with my web server in DMZ network

6

Apr 12 2019

16:58:49

302014

62.245.164.71

443

172.16.0.2

57288

Teardown TCP connection 1427 for outside:62.245.164.71/443 to DMZ:172.16.0.2/57288 duration 0:00:05 bytes 56148 TCP FINs

[joseph.h.nguyen]

Try to use packet-tracer to help diagnose your traffic flow.  To learn how, see https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/p1.html.  You can use this technique either on the CLI or ASDM GUI.

[Richard Burts]

While packet tracer is a very helpful tool I am not sure that it will be helpful for this issue. According to the original post the reason that the connection is torn down is

Teardown TCP connection 1427 for outside:62.245.164.71/443 to DMZ:172.16.0.2/57288 duration 0:00:05 bytes 56148 TCP FINs

We do not know enough about the environment here to know what came before this message, what kind of connection attempt it was, and what other responses might have been received. But at this point the remote device appears to be sending a TCP FIN which is their way to terminate this connection. You probably need more information about the remote device to understand why it chooses to terminate the connection.

HTH

Rick

[maamon.albattah]

hier are the configurations:

Result of the command: "show run access-list"

access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit icmp any any
access-list DMZ_access_in_1 extended permit ip any any
access-list outside_access_in extended permit ip any any
access-list outdmz extended permit tcp any object Web eq https

Result of the command: "show run nat"

nat (inside,outside) source static any any destination static vpn-object vpn-object no-proxy-arp route-lookup
nat (inside,outside) source static any any destination static NETWORK_OBJ_10.0.19.0_25 NETWORK_OBJ_10.0.19.0_25 no-proxy-arp route-lookup
nat (inside,DMZ) source dynamic any interface
nat (DMZ,inside) source dynamic any interface
!
object network obj-inside
nat (any,outside) dynamic interface
object network obj-anyconn
nat (any,outside) dynamic interface
object network Web
nat (DMZ,outside) static interface net-to-net service tcp https https
object network dmz-net
nat (DMZ,outside) dynamic interface

the web server hat IP address: 172.16.0.2 and it is accessable from internet but when the App client try to connect , occur theses Fehler and the client can not register.

Thanks alot

[Richard Burts]

If the web server is 172.16.0.2 then what is the other address found in the log message 62.245.164.71 

HTH

Rick

[maamon.albattah]

it is a client try to connect to Web server

[maamon.albattah]

Packet Tracer is working without Problems!

Thanks alot!