FWSM Problem: Terminating TCP-Proxy Connection Error Message

[maktala007]

Hi All,

We are receiving an error "%FWSM-5-507001: Terminating TCP-Proxy connection from interface_inside..." in our FWSM 4.0 (12).

The RTSP inspection already disabled in the firewall. But the problem still persits. I have captured and analyzed the firewall logs. Found that the server with IP 172.30.3.230 is sending 'RST' packet thus responsible for the session termination.

When we moved the server IP segment from the firewall to the switch everything working fine. This clearly shows that the problem is with FWSM.

Please help me if any one have suggestion to resolve this problem.

Thanks in advance,

Rajender

[Anu M Chacko]

Hi Rajender,

Could you post the output of "sh service-policy" from the FWSM here?

Regards,

Anu

[maktala007]

Hi Anu,

Please find below the output of 'show service-policy":

Global policy:

  Service-policy: CSM_POLICY_MAP_global_2

    Class-map: inspection_default

      Inspect: dns maximum-length 1260, packet 539490201, drop 0, reset-drop 0

      Inspect: ftp, packet 878867, drop 0, reset-drop 0

      Inspect: h323 h225, packet 0, drop 0, reset-drop 0

      Inspect: h323 ras, packet 3, drop 3, reset-drop 0

      Inspect: netbios, packet 29999331, drop 0, reset-drop 0

      Inspect: rsh, packet 0, drop 0, reset-drop 0

      Inspect: skinny, packet 133, drop 0, reset-drop 0

      Inspect: sqlnet, packet 231, drop 0, reset-drop 0

      Inspect: sunrpc, packet 786816, drop 0, reset-drop 0

      Inspect: tftp, packet 8985750, drop 0, reset-drop 0

      Inspect: xdmcp, packet 43, drop 0, reset-drop 0

    Class-map: CSM_CLASS_MAP_sip_1

      Inspect: sip, packet 0, drop 0, reset-drop 0 Global policy:

Regards,

Rajender

[Anu M Chacko]

Hi Rajender,

The captures show all traffic detined to port 2000, which is skinny. Could you disable inspection of skinny and test?

Let me know.

Regards,

Anu

[maktala007]

Hi Anu,

In fact I have already done that (disabling 'skinny' inspection for testing purpose). The actual captured logs were taken when the 'skinny' was disabled. Disabling 'skinny inspection'  not worked, then we decided to move the IP segment from the firewall to L3 switch and re enabled the 'skinny inspection'.

Regards,Rajender

[Anu M Chacko]

Hi Rajender,

I see. In the captures, i also see that there are out of order packets. Do you have "sysopt np-completion unit" enabled on the FWSM? This will ensure that the FWSM does not re-order the packets that are received.

Let me know.

Regards,

Anu