TCP packet out of state: First packet isn't SYN TCP Flags: SYN-ACK

[jamal_shah]

Hi,

I am getting this error in the Firewall logs.

Can someone please advise.

Thanks

[Chris_Atkinson]

Could be due to aggressive aging if the memory consumption is high?

Other possibilities may include:

- Connection persistence as relevant to policy install

- Asymmetric routing

[the_rock]

I agree with @Chris_Atkinson . That sort of message is asymmetric routing literally 9 times out of 10. Please do fw monitor capture and see what it shows.

Andy

[Timothy_Hall]

As other posters have observed this is generally caused by asymmetric routing.  However it can also occur in cases where the amount of time between the SYN and SYN-ACK exceeds the default TCP start timeout of 25 seconds, caused by high packet loss or extreme network congestion.  While exceeding 25 seconds for this simple exchange seems impossible, keep in mind that if Aggressive Aging is active this timer will be reduced to 5 seconds which is much more plausible.  

If Aggressive Aging seems to be constantly active on the firewall for no obvious reason, it is usually due to memory issues on non-VSX firewalls as mentioned in the free addendum for the third edition of my Max Power book: