need help with SYN Timoeout message

[SOL10]

hi all,

Im trying to establish a connection from a server sitting behind a dmz interface to a linux box on port 4573 (sitting behind the inside interface) the connection is establish and the access list is allowing the packet through but i then get this message:

"Teardown TCP connection 606 for dmz xx.xx.xx.xx/37595 to inside xx.xx.xx.xx/4573 duration 0:00:30 bytes 0 SYN Timeout"

Any ideas why this might be happening?

Regards

[Farrukh Haroon]

This means that the client was unable to establish a three-way handshake (SYN, SYN-ACK and so on) to the server.

I would check the following:

1) Try opening/testing the application from the LAN behind the ASA first, if this is working proceed to the next step.

2) On the internal client that was used for testing in Step (1) check if the service is establishing a connection on the same TCP flow as the one initiated by the client, and there is no dynamic behaviour like in some protocols like FTP, X-Windows etc. This can be done by observing the netstat output using the built-in netstat utility or some third-party package like TcpView.

3) Try troubleshooting with the packet-tracer command on your ASA box

Regards

Farrukh

[SOL10]

Salaams Farrukh

Thanks for your response. The problem was that the traffic was going through the default gateway of the server concerned(which was the inside intf or another asa) when it should it have been going throuhg the inside intf of the asa to which the remote server is connected (off the dmz). I hope this makes sense as we have a very peculiar setup.

Sol

[Farrukh Haroon]

Wasalam

Great to see you have it working now :)

Regards

Farrukh