Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

need help with SYN Timoeout message

hi all,

Im trying to establish a connection from a server sitting behind a dmz interface to a linux box on port 4573 (sitting behind the inside interface) the connection is establish and the access list is allowing the packet through but i then get this message:

"Teardown TCP connection 606 for dmz xx.xx.xx.xx/37595 to inside xx.xx.xx.xx/4573 duration 0:00:30 bytes 0 SYN Timeout"

Any ideas why this might be happening?



Re: need help with SYN Timoeout message

This means that the client was unable to establish a three-way handshake (SYN, SYN-ACK and so on) to the server.

I would check the following:

1) Try opening/testing the application from the LAN behind the ASA first, if this is working proceed to the next step.

2) On the internal client that was used for testing in Step (1) check if the service is establishing a connection on the same TCP flow as the one initiated by the client, and there is no dynamic behaviour like in some protocols like FTP, X-Windows etc. This can be done by observing the netstat output using the built-in netstat utility or some third-party package like TcpView.

3) Try troubleshooting with the packet-tracer command on your ASA box



Community Member

Re: need help with SYN Timoeout message

Salaams Farrukh

Thanks for your response. The problem was that the traffic was going through the default gateway of the server concerned(which was the inside intf or another asa) when it should it have been going throuhg the inside intf of the asa to which the remote server is connected (off the dmz). I hope this makes sense as we have a very peculiar setup.


Re: need help with SYN Timoeout message


Great to see you have it working now :)



CreatePlease to create content