Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
praveshnayal
Explorer

TCP out of state drop observed before the timeout configured in firewall

Hello all,

We have encountered TCP out of state drops stating First Packet isn't SYN just after 10 mins of the connection initiation from the source. (After inactivity)

The timeout configured in the service port is default 3600 seconds so as per my understanding the connection entry should be there on the firewalls for 1 hour but in this case once the user returns to the application after 10 minutes the user gets disconnected and we can see out of state drop logs as mentioned above.

What could be the possible reasons for this behaviour? 

Thanks for any suggestions in advance.

0 Kudos
7 Replies
PhoneBoy
Admin
Admin

Version/JHF of gateway involved?
What is the precise service in question?
Have you performed any tcpdumps to see what the application is doing during this time?

0 Kudos

How is the memory utilisation of the appliance, any signs that aggressive aging has been activated?

0 Kudos
Cihat_Bulut
Contributor

If it is R81.10 JHF 66, then R&D is working on it. The fix will be soon.

0 Kudos

Did you do a policy install between establishing the connection and "the user returns to the application after 10 minutes"?

If yes, then you can check sk103598 to see if you match a scenario from there.

0 Kudos
Cihat_Bulut
Contributor

From R&D;

We have a new workaround to be implemented on the GW:

Please run # fw ctl set int fw_tcp_enforce_half_closed_timeout 1

Install policy.

Hi Cihat,

Is there some SK article regarding this or logged as open bug somewhere to read more details of this condition?

0 Kudos
PhoneBoy
Admin
Admin

0 Kudos