Return traffic being blocked in FTD firewall

[mjrosana02]

Hi all,

Is anyone here also experience this kind of issue on the FTD?  we notice that some return traffic being blocked on the FTD.

Thanks for the answer!!

[MHM Cisco World]

Did you check ""show conn"" to see if there active conn in ftd for retrun traffic 

MHM

[Marvin Rhoads]

What indicators are you seeing to lead to believe this is the case?

Have you confirmed the routing is symmetric (return traffic coming via the same interface via which it leaves)?

[mjrosana02]

Hi Marvin,

Here is the sample logs, From the existing rule the source is 172.16.x.x network and the destination is 192.168.24.40 on port 8443, there is no issue from this direction. But we are seeing these logs where 192.168.24.40 is communicating back to 172.16.x.x using port 8443 but the destination is the random ports. 

[Massimo Baschieri]

That's return traffic which hits the firewall after the session has already been closed, that is the firewall doesn't find a xlate for those sessions, I suppose this can happen for many reasons, duplicated packets, high latency, network issues, server issues etc..

Nothing to be worried about usually

[ccieexpert]

Please provide logs and if possible packet captures showing this behavior.

[mjrosana02]

Hello @ccieexpert ,

Good day!
Please refer to my comments above.

Thanks,

[ccieexpert]

that doesnt help as it only shows the reverse packets that are blocked..

first question is there any issue ? or you are just checking why they are happening ?

You should get a syslog of the entire flow from start to finish as shown in the below link.

That will help to see when the CONN was built and when it was teardown.. It is possible that a conn was reset/torn down by the firewall,  and then a return packet came after that in the reverse direction, thus my question is it affecting anything..

Please get us the syslog/log for the sourde/destination flow, which allow us more insight.

https://www.lammle.com/post/cisco-firepower-ftd-syslog-messages-and-how-to-see-cisco-ftd-lina-events/