interruptions of connection through ASA 5520

[miroslavpetkovic]

Hi,

I have a problem with the connections to the remote webservice passing through ASA 5520 firewall. Connections are usually  interrupted in perod of half an hour in every few days.

This ASA 5520 firewall is only one firewall in a path to the remote webservice.

During the interruption I find the logs:

UTC: %ASA--4-419002: Duplicate TCP SYN from dmz1:x.x.x.x/.... to outside:y.y.y.y/p with different initial sequence number

Teardown TCP connection 28309406 for outside:y.y.y.y/p to dmz1:x.x.x.x/.... duration 0:00:30 bytes 0 SYN Timeout

How I could find root cause? Could it be solution implemetation of TCP State Bypass?

Best ragrds,

Miroslav Petkovic

[Jennifer Halim]

With that error message, it seems to be TCP issue with the client trying to access the server using a duplicate SYN with different sequence number. It might have been using a connection which is still opened but has been closed on the FW.

You can implement TCP State Bypass, however that will bypass security for TCP state checking as well. The reason why FW is denying it is because it doesn't comply with TCP standard.