topic Re: tcpout of state first packet isnt sync in Firewall and Security Management

tcpout of state first packet isnt sync

tavi0906 — Thu, 28 Sep 2023 11:49:42 GMT

we are receiving logs with first packet isnt sync. as of now for work around we have disabled the tcp out of state in global properties. but its not an good idea to keep this disabled. so instead of disabling how can we over come this issue?

and what are steps to troubleshoot ?

Re: tcpout of state first packet isnt sync

Chris_Atkinson — Thu, 28 Sep 2023 12:56:23 GMT

Please share the gateway version and jumbo level, in addition:

Is the gateway under memory capacity pressure - any aggressive aging logs?

Is the issue specific to a certain application?

How about the routing have you checked for asymmetrical routing?

Re: tcpout of state first packet isnt sync

the_rock — Thu, 28 Sep 2023 13:45:46 GMT

I assume you mean first packet isnt SYN? Anyway, what really means in layman's terms is that connection is not completing to the point of 3-way handshake, syn-synack-ack

I would say run below captures. Lets assume src is 1.1.1.1 and dst is 2.2.2.2 and port is 444

tcpdump -enni any host 2.2.2.2 and port 444

fw monitor -e "accept host(2.2.2.2) and port(444);"

fw monitor -e "accept host(1.1.1.1) and host(2.2.2.2) and port(444);"

fw monitor -F '1.1.1.1,0,2.2.2.2,444,0" -F "2.2.2.2,0,1.1.1.1,444,0"

Idea is when you do -F flad you follow "srcip,srcport,dstip,dstport,protocol"

You can also refer to great site my colleague made over the years for captures/debugs on different vendors

Andy

www.tcpdump101.com

Re: tcpout of state first packet isnt sync

PhoneBoy — Thu, 28 Sep 2023 19:19:11 GMT

Fix the application that is causing the problem.
If that's not possible, you can disable it for a specific flow by following the steps here: https://support.checkpoint.com/results/sk/sk11088