topic Re: What is "SYN packet in reversed direction"? in Firewall and Security Management

What is "SYN packet in reversed direction"?

Fung_To_Puk — Wed, 04 Mar 2020 03:58:18 GMT

There are 2 devices 192.2.1.65(A) and 10.251.0.64(B) which B would send signal throug port 8443 to A to make it initiate OpenVPN connection from A to B both on port 8000.

But the connection is dropped by "SYN packet in reversed direction", what is this thing?

Re: What is "SYN packet in reversed direction"?

PhoneBoy — Thu, 05 Mar 2020 03:42:04 GMT

What version/JHF level?
Can you provide a screenshot of the log card with sensitive data redacted?

Re: What is "SYN packet in reversed direction"?

Fung_To_Puk — Thu, 05 Mar 2020 04:01:42 GMT

Re: What is "SYN packet in reversed direction"?

PhoneBoy — Thu, 05 Mar 2020 16:55:22 GMT

What about the first question I asked (version/JHF level)?

I've never seen this error message before and it's not even in SK.
However, if we take the message at face value, the destination sent a packet with the SYN flag (and not the ACK flag) set.
Normally, what should happen with the establishment of a TCP connection is the following:

Client (origin/source of communication) sends SYN packet to server (destination of communication)
Server sends SYN ACK packet back to client
Client sends ACK packet to server
Client and server exchange data normally per TCP and application conventions

As the destination sending a SYN packet is not considered normal behavior, we drop it.

You can disable this state checking (e.g. the "Drop Out of State TCP Packets" setting in Global Properties), but this is not recommended.

Re: What is "SYN packet in reversed direction"?

Fung_To_Puk — Fri, 06 Mar 2020 07:36:24 GMT

Its R80.10 with JHF take 56

Re: What is "SYN packet in reversed direction"?

PhoneBoy — Fri, 06 Mar 2020 18:33:03 GMT

That's a fairly old JHF, recommend upgrading to a more recent one at the very least, if not one of the more recent versions.
Might also be worth a TAC case.