Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA log - Deny tcp fin ack on int mgmt

While in ASDM via the management interface, I get ASA log entries every 30 seconds with 'deny TCP (no connection) from *** to ***/443 flags FIN ACK on interface management'. Operation of ASDM is not impacted, but I'd like to correct this if possible.

New Member

Re: ASA log - Deny tcp fin ack on int mgmt

I have exactly the same problem, and would love to know a fix too.

New Member

Re: ASA log - Deny tcp fin ack on int mgmt

Opened a TAC case. I'll make sure the results get posted.


Re: ASA log - Deny tcp fin ack on int mgmt

I did a recreate in my lab.I saw the exact same behaviour.

What we all are seeing appears to be a normal behavior.

When you load up ASDM, there is one main connection to the ASA interface on port 443 via which GUI is populated. The other possible connection

could be logging connection via which ASDM gets logs from ASA.

Apart from this, if there is any command which you need to execute from ASDM, or when you navigate through ASDM windows/frames, most of them would cause ASDM to send a command to ASA and use the output to populate

the fields on GUI. These commands are *not* sent on the same connection via which GUI is visible, but via a new separate connection. As soon as

ASA gets the output, the connection is closed and the FIN+ACK is denied because connection no longer exists.

New Member

Re: ASA log - Deny tcp fin ack on int mgmt

That is exactly my point and I would view this as a deficiency. The ASA should be able to properly terminate connections, especially from / to itself.

Let me know if you agree or disagree with the assessment.

Also, I opened a dialog on NetPro on this topic. Would you be willing to post your respose there too? At least one other person was seeking a resolution for this issue.


Mike Palmer

Bremer Financial.