Hello all. It was just last weekend that I put in my first zone firewalled router into a live environment.
Now, with ip inspect log drop_pktset, I see many many entries of dropped packets. Often these are not due to explicit rules I've set but instead, due to I imagine just integrated firewall drop criteria. For example:
177497: *Nov 9 2012 08:56:16.916 PCTime: %FW-6-DROP_PKT: Dropping tcp session <my public IP>:49399 <someone else's public IP>:443 due to RST inside current window with ip ident 0
I get about 4 or 5 different types of conditions. Always with "ip ident 0" whatever that is. There's this RST one, then there's dropping packets due to Out of Order Segment (this is from an email filtering service that then sends the clean emails to our mail server). Also there is often dropping tcp session due to Stray Seegment, usually this one comes from internal systems going outbound. Again, these are not drops due to rules I've set, these are apparently just built-in drop actions esigned into the firewall itself.
Though I would much appreciate any direct explanation from fellow forum members about any specific condition above, I would be happy also with any kind of reference document that explains all of the ones found in an IOS zone firewall so I could referenc them.
I googled some of these and get some partial answers but generally it's a lot of opinion and less facts. Perhaps what is fact is Out of Order: you can set up a parameter map to create an out of order buffer so your firewall will allow more OOO packets before inspcting them, thus you won't have the out of Order rops occuring. I don't know what would be considdred tolerable OOO windowing since TCP by design allows for this to occur but maybe the FW is less tolerant?
Thanks for any insight.
