Resolved! Understanding teardown from log
Is the Reset-I always from the device on the higher security level interface (in this case 172.16.112.10/3389?In the second case, what conclusions can be drawn from the teardown information "TCP FINs" - who is it that send the first FIN?I'm strugglig...