Failing inbound connection through a PIX

Unanswered Question
Feb 26th, 2007

My public IP address changed for my Road Runner connection so I adjusted my access-list and static NAT statements to reflect the change so users could connect to a FTP server on the Inside of my network. After making the changes I?m now getting a log message I?ve never seen and I was curious if anyone had.

106001: Inbound TCP connection denied from to flags SYN on interface outside


My config:

PIX Version 6.3(5)

object-group service FTP_Port tcp

port-object eq 19999

access-list outside permit tcp any host object-group FTP_Port

ip address outside dhcp setroute (My IP is

ip address inside

ip audit info action alarm

ip audit attack action alarm

global (outside) 1 interface

nat (inside) 1 0 0

static (inside,outside) tcp 19999 ftp netmask 0 0


This is what I get from Cisco.

Error Message %PIX-2-106001: Inbound TCP connection denied from IP_address/port to

IP_address/port flags tcp_flags on interface interface_name

Explanation: This is a connection-related message. This message occurs when an attempt to connect

to an inside address is denied by your security policy. Possible tcp_flags values correspond to the

flags in the TCP header that were present when the connection was denied. For example, a TCP

packet arrived for which no connection state exists in the PIX Firewall, and it was dropped. The

tcp_flags in this packet are FIN and ACK.

The tcp_flags are as follows:

? ACK?The acknowledgment number was received.

? FIN?Data was sent.

? PSH?The receiver passed data to the application.

? RST?The connection was reset.

? SYN?Sequence numbers were synchronized

? URG?The urgent pointer was declared

Recommended Action None required.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
acomiskey Mon, 02/26/2007 - 19:06


static (inside,outside) tcp interface 19999 ftp netmask


access-list outside permit tcp any interface outside object-group FTP_Port

anowell Mon, 02/26/2007 - 19:12

I replaced my line with the one you gave but got the same result. Any other ideas?

Thanks in advance!

Jon Marshall Mon, 02/26/2007 - 23:58


When you changed the translation did you clear the xlate entry for it ?


armin.kraus Tue, 06/12/2007 - 04:02


i have the same error with a my pix running version 7.2.2. Did you solve the problem, or have you any suggests for me?

Jon Marshall Tue, 02/27/2007 - 04:20


Sorry for the basic stuff but how many lines are there in your access-list that is applied to the outside interface ?



This Discussion