Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
praveshnayal
Explorer

TCP out of state drop observed before the timeout configured in firewall

Hello all,

We have encountered TCP out of state drops stating First Packet isn't SYN just after 10 mins of the connection initiation from the source. (After inactivity)

The timeout configured in the service port is default 3600 seconds so as per my understanding the connection entry should be there on the firewalls for 1 hour but in this case once the user returns to the application after 10 minutes the user gets disconnected and we can see out of state drop logs as mentioned above.

What could be the possible reasons for this behaviour? 

Thanks for any suggestions in advance.

0 Kudos
7 Replies
PhoneBoy
Admin
Admin

Version/JHF of gateway involved?
What is the precise service in question?
Have you performed any tcpdumps to see what the application is doing during this time?

0 Kudos
Chris_Atkinson
Employee Employee
Employee

How is the memory utilisation of the appliance, any signs that aggressive aging has been activated?

CCSM R77/R80/ELITE
0 Kudos
Cihat_Bulut
Contributor
Contributor

If it is R81.10 JHF 66, then R&D is working on it. The fix will be soon.

0 Kudos
Tobias_Moritz
Advisor

Did you do a policy install between establishing the connection and "the user returns to the application after 10 minutes"?

If yes, then you can check sk103598 to see if you match a scenario from there.

0 Kudos
Cihat_Bulut
Contributor
Contributor

From R&D;

We have a new workaround to be implemented on the GW:

Please run # fw ctl set int fw_tcp_enforce_half_closed_timeout 1

Install policy.

Infrastructure3
Explorer

Hi Cihat,

Is there some SK article regarding this or logged as open bug somewhere to read more details of this condition?

0 Kudos
PhoneBoy
Admin
Admin

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events