CSM RST issues after SYN packet

Unanswered Question
Feb 7th, 2008
User Badges:


A couple of CSMs in a campus manage costumer's WAP browsing service. A VIP virtualizes WAP1 and WAP2 service on different tcp, udp port and CSM balances it to WAP gateway proxies.

WAP gateway's proxies initiate new connection to internet passing through CSM.

HTTP sessions are intercepted and balanced to transparent proxies to provide enrichment.

NAT is implemented for all traffic that goes out to CSM.

Other flows are managed by this CSM but they aren't involved in the reset issues.


Costumer sets up connection with his WAP gateway. WAP gateway initiates connection to internet properly and flow is properly balanced to transparent proxies.

Transparent proxy also initiates new connection to internet.

Sometime CSM sends RST to transparent proxies and they send to all other elements a 502 bad gateway error.

RST packet is sent in two different cases.

1. RST after a few SYN packets, 30 second between first and last SYN.

2. RST immediately after the first SYN packet from transparent proxies.

My ideas:

I putted a test WEB server on the Client VLAN of CSM to leave out other network elements or internet problems

The second issue probably is a sell-out of some resources. Looking “LB Rjct: no cl NAT port” counter on CSM's tech-support it increases. Probably one IP of NAT isn't enough anymore.

No ideas for the first issue.

Do you have any idea?

Thanks in advance.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Gilles Dufour Thu, 02/07/2008 - 04:45
User Badges:
  • Cisco Employee,

when you say, RST after a few SYN, does it mean the 3-way handshake never completes ?

So, the server never responds with a SYN/ACK ??

30 sec is the pending timeout on the CSM.

That's the time we allow the tcp 3-way handshake to complete.

You can increase this timeout with the command 'pending ' under the vserver.

You can verify if this is a pending timeout issue w/ the command :

sho mod csm 3 tech proc 1 | i Pending


roberta979 Thu, 02/07/2008 - 08:16
User Badges:

Hi Gilles,

yes, it does. SYN/ACK never arrives by server.

I'll do it asap.

What about second issue? Do you think my idea is correct?



Gilles Dufour Fri, 02/08/2008 - 00:51
User Badges:
  • Cisco Employee,

your idea for the 2nd problem looks good to me.



This Discussion