TCP Connection Flags

[giancarlo.mannato]

A client C1 on the inside does connect in RDP to a server S1 on the outside.

Via CLI I can see (show conn | include <IP_src_C1>):

TCP <interface_inside> <IP_src_C1>:50299 <interface_outside> <IP_dest_S1>:3389  . . . FLAGS – UBOI

Then, a client C2 connects to a server S2, and I see (show conn | include <IP_src_C2>):

TCP <interface_outside> <IP_dest_S2>:3389  <interface_inside> <IP_src_C2>:49423 . . . FLAGS – UOI

Does anyone know why in the first case, the source field contains the IP source of the connection and there is the “B” flag (initial SYN from outside) while in the second case,  the source field contains the IP destination of the connection (without B flag)?

Thank you!

[AMediaFilm]

Let me guess. Is it because they translated via different nat rules?

Is `sh nat <IP_dest_S1>` confirms my guess?

[giancarlo.mannato]

It happens even without any NAT.
In the example, I'm going from the client to the internal DMZ ...

But in other cases, I have a Dynamic Policy on the inside interface that translates the local address in a public one on the outside interface, and when I do a connect to a server from the Live environment I see the "conn" in straight sense, but when I do a connect to a server from the Test environment, the "conn" is in the other side...