topic Re: TCP packet out of state: First packet isn't SYN in General Topics

TCP packet out of state: First packet isn't SYN

Abhishek_Kumar1 — Sun, 14 Oct 2018 09:50:25 GMT

Hi -

I have a firewall in cluster with R77.20, one of interface traffic in not working after failover (active to standby)

I checked routing and all configuration, all looks good.

while we capture the traffic its showing

(TCP packet out of state: First packet isn't SYN tcp_flags: PUSH-ACK)

I also try to disable statefull packet inspection from global property.

Please provide us solution for this.

Re: TCP packet out of state: First packet isn't SYN

PhoneBoy — Wed, 24 Oct 2018 05:04:04 GMT

That suggests the traffic in question isn't getting synced to the other cluster member.

Or that the connection "timed out" and it just happened to do so during the failover.

Re: TCP packet out of state: First packet isn't SYN

Danny — Wed, 24 Oct 2018 05:55:16 GMT

And as a side note: R77.20 is out of support since 2017. You may first want to upgrade to a supported release before disabling stateful inspection.

Re: TCP packet out of state: First packet isn't SYN

Abhishek_Kumar1 — Thu, 15 Nov 2018 18:58:33 GMT

When traffic is bpassing through primary firewall every thing is working, when any of the reason if failover heppen and traffic shifted to secondary firewall then one of interface traffic is not working and getting tcp sync error.