cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

8194
Views
0
Helpful
1
Replies
tom.kivlin
Beginner

TCP Reset-O - which is the outside interface?

Hi all,

I'm troubleshooting a peculiar problem and have got to the firewall logs and have confused myself. Here is the specific output that I'm referring to:

2011-11-14 11:42:16         Local4.Info            x.x.x.x        Nov 14 2011 11:42:16: %ASA-6-302014: Teardown TCP connection 3510106301 for INT-AAAA:a.a.a.a/54534 to INT-BBBB:b.b.b.b/443 duration 0:00:04 bytes 108 TCP Reset-O 

The "TCP Reset-O", from what I've read, means that the reset was received on the outside interface, so was generated by something on that interface, correct?

The problem is, both of those interfaces have the same security level of 100, and the "Enable traffic between two or more interfaces which are configured with the same security level" option is enabled - this reset is an intermittent thing for a particular TCP stream, not for everything.

Is there any other way of determining which interface is classed as the 'outside' with regards the Reset-O (and Reset-I) commands, when both interfaces share the same security level?

Thanks in advance,

Tom

1 REPLY 1
Maykol Rojas
Cisco Employee

If you place a capture, you will be able to see which one is sending the RST packet.

https://supportforums.cisco.com/docs/DOC-1222

You will be able to see an R flag, that will tell you which one is sending the packet.

Mike

Mike
Create
Recognize Your Peers
Polls
Which of these topics should we host an event in the Community?

Top Choice: ISE Demo (100%)

Content for Community-Ad