'TCP packet out of state' drops

[arcotangente]

Hi guys,

We are troubleshooting an issue and see many HTTPS packets dropped with the following message in the logs:

'TCP packet out of state -First packet isn't SYN'

I've tried to disable this protection for one specific source, so open Inspection settings, and added an Exception for this specific source IP (all protections, profiles and destinations)

However I still see packets being dropped with the same message in the logs. 

Is there a way to bypass an specific source or destination of this protection? 

Thanks

[Timothy_Hall]

What TCP flags (RST, FIN, ACK, etc.) are you seeing on the packets dropped as out of state?  If they are RST or FIN the connection is already dead so you can probably ignore those.  If the flags on the dropped packets are SYN and ACK (or perhaps just ACK), that may indicate asymmetric routing going around the firewall.  If the flags on the dropped packet are some combo of only ACK/PSH/URG usually that means the connection was timed out by the firewall, in that case you can try increasing the service timeout for HTTPS on the Advanced screen of the matching HTTPS service.

[arcotangente]

Thanks Timothy,

The flags are 'PUSH-ACK'

BR

[Timothy_Hall]

Try increasing the timeout for the HTTPS service on its Advanced screen, and make sure you modify the correct HTTPS/port 443 service that is actually matching the problematic traffic as there may be several defined.

[arcotangente]

Hi,

Finally the issue got fixed after a reboot of the secondary node, while troubleshooting another issue. Difficult to understand what happened

Thanks anyway!