deny tcp (no connection)

[hedyeh razazan]

Hi,

in the FWSM we have too many "deny tcp (no connection)" log and tcp connections disconnect randomly.

some log events:

Deny TCP (no connection) from 10.4.2.1/80 to 10.5.46.2/1395 flags ACK on interface inside.

[Julio Carvajal]

Hello Hedhyeh,

This is a routing issue, this is known as a stateful tcp firewall issue.

The problem is that the firewall is receiving a ack packet on the inside interface of a connection where he has not received a SYN packet, so of course he will drop it!

You have two options:

1- check why the routing issue is happening, get into the real root of the issue

2- the easyest way to solve it, configured a tcp state bypass policie to tell the ASA: Do not drop a tcp packet if the tcp 3 way handshake is not used.

Hope this helps.

Julio

Do rate all the helpful posts