Solved

I have an ASA with the following:  What does the following mean?   "Deny TCP (no connection) from/to flags FIN ACK on interface inside"

Posted on 2009-07-15
4
1,160 Views
Last Modified: 2013-11-22
I keep getting the above error.  It is not explicitly denying the packet, but was wondering what the error means.
0
Comment
Question by:NWSBexch
  • 2
4 Comments
 
LVL 34

Expert Comment

by:Istvan Kalmar
Comment Utility
It means basically the TCP packet was sent with something other than the syn flag sent. Therefore the ASAwould check its connection table, no previous connection existed and the packet gets denied.
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
Comment Utility
But I seen this messege when I used 8.0.4 on 5505 with Oracle communication, after that I downgraded the ASA the problem is discontinued!

Do you have a problem on qour network, or you inquiring?
0
 
LVL 15

Accepted Solution

by:
Voltz-dk earned 500 total points
Comment Utility
It is a common log.  It's a packet that is received after the connection has been closed down in the ASA.
If you have syslog on informational, you'll see that you receive a Teardown syslog (which also states why it's closed) on the connection in question prior to this deny.
The packet is indeed denied, but it's got FIN flag set so it's part of the graceful connection teardown anyways.
0
 

Author Comment

by:NWSBexch
Comment Utility
So this is not necessarily a bad thing, but just part of the "tear down" process?
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Changing DHCP scope with a different subnet mask 3 59
GRE Trunnel with IPsec Encryption Issue 3 33
NSD FAIL 2 19
DHCP on ASA 3 20
If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
For those of you actively in the Malware fightling business, we now have available an amazing new tool in the malware wars (first recommended to me by rpggamergirl (http://www.experts-exchange.com/M_3598771.html), the Zone Advisor for the Virus and …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now