TCP RESET -I Cisco ASA 5505 running 823-k8

[aaziz2016]

Hello Newbie here.

I am dealing with a client who has a Cisco ASA 5505 and we use a rsync_wrapper that basically sends their data over the wire to our data center. This is the only client where we are running into the following issue

"Teardown TCP connection 165389991 for outside:162.x.x.x/4018 to inside:192.168.0.226/55016 duration 0:39:54 bytes 90011062 TCP Reset-I"

some more

We then see the firewall destroy the connection:
2016-05-18 01:50:15   Local4.Info      192.168.0.2     %ASA-6-302014: Teardown TCP connection 165427669 for outside:162.x.x.x/4018 to inside:192.168.0.226/55152 duration 1:05:22 bytes 481879286 TCP Reset-I
 
Followed by a session recreation:
2016-05-18 01:50:31   Local4.Info      192.168.0.2     %ASA-6-302013: Built outbound TCP connection 165460204 for outside:162.x.x.x/4018 (162.x.x.x/4018) to inside:192.168.0.226/55301 (172.16.10.75/29672)
 

The rsync get restart when it tries to scan and send large edb databases, it keeps resetting every 30 min or so. I am puzzled and can't seem to find a possible solution. Our rsync_wrapper simply send data to 162.x.x.x using port 4018, i am confident that it is the ASA because if i replaced with any other basic firewall. It simply just works.

Any help will be highly appreciated

Arsi

[aaziz2016]

Any clues plz?

[Rishabh Seth]

Hi,

Based on the syslog message 302014 it looks like that the host on inside is sending reset and that is what is causing asa to clear session.

Now, you have mentioned that removing asa with other firewall resolves the problem. Can you verify and share what changes in the traffic flow when you replace the firewall. Also check on the internal host logs to identify the reason for disconnection. 

I have personally seen some issues where timeout on the application causes the reset of the connection so you can try running wireshark for the entire session on the end client and check what happens just before reset of connection and if you notice latency causing the reset of connection then you can tweak timeout on the application.

Based on the syslog the issue seems to be with internal host.

Hope it helps.

RS

Rate if it helps.

[Massimo Baschieri]

Did you check tcp timeouts?

Maybe the session gets idle for enough time to trigger a timeout

[aaziz2016]

Hi Massimo,

Thank you for the response, TCP timeout was the first thing i set to 4 hours, but unfortunately it is still happening.

Arsi