05-28-2008 07:31 AM - edited 03-11-2019 05:51 AM
hi all,
Im trying to establish a connection from a server sitting behind a dmz interface to a linux box on port 4573 (sitting behind the inside interface) the connection is establish and the access list is allowing the packet through but i then get this message:
"Teardown TCP connection 606 for dmz xx.xx.xx.xx/37595 to inside xx.xx.xx.xx/4573 duration 0:00:30 bytes 0 SYN Timeout"
Any ideas why this might be happening?
Regards
05-28-2008 11:29 PM
This means that the client was unable to establish a three-way handshake (SYN, SYN-ACK and so on) to the server.
I would check the following:
1) Try opening/testing the application from the LAN behind the ASA first, if this is working proceed to the next step.
2) On the internal client that was used for testing in Step (1) check if the service is establishing a connection on the same TCP flow as the one initiated by the client, and there is no dynamic behaviour like in some protocols like FTP, X-Windows etc. This can be done by observing the netstat output using the built-in netstat utility or some third-party package like TcpView.
3) Try troubleshooting with the packet-tracer command on your ASA box
Regards
Farrukh
05-29-2008 12:20 AM
Salaams Farrukh
Thanks for your response. The problem was that the traffic was going through the default gateway of the server concerned(which was the inside intf or another asa) when it should it have been going throuhg the inside intf of the asa to which the remote server is connected (off the dmz). I hope this makes sense as we have a very peculiar setup.
Sol
05-29-2008 12:23 AM
Wasalam
Great to see you have it working now :)
Regards
Farrukh
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: