Hi all,
I'm troubleshooting a peculiar problem and have got to the firewall logs and have confused myself. Here is the specific output that I'm referring to:
2011-11-14 11:42:16 Local4.Info x.x.x.x Nov 14 2011 11:42:16: %ASA-6-302014: Teardown TCP connection 3510106301 for INT-AAAA:a.a.a.a/54534 to INT-BBBB:b.b.b.b/443 duration 0:00:04 bytes 108 TCP Reset-O
The "TCP Reset-O", from what I've read, means that the reset was received on the outside interface, so was generated by something on that interface, correct?
The problem is, both of those interfaces have the same security level of 100, and the "Enable traffic between two or more interfaces which are configured with the same security level" option is enabled - this reset is an intermittent thing for a particular TCP stream, not for everything.
Is there any other way of determining which interface is classed as the 'outside' with regards the Reset-O (and Reset-I) commands, when both interfaces share the same security level?
Thanks in advance,
Tom
