topic Re: Session Agged out in logs in General Topics

Session Agged out in logs

mailmepupun2010 — Fri, 29 Oct 2021 14:26:14 GMT

Hi Team,

need your support on my issue aged out and incomplet application for port 1433.

However, the policy is allow.

Need how to fix this..

Same subnet other two IPs working find ,But one of the IP is agged out

Re: Session Agged out in logs

BPry — Fri, 29 Oct 2021 22:26:39 GMT

aged-out just means the firewall never gets a RST or FIN on TCP packets, or is common and expected on UDP traffic. Incomplete just means that not enough traffic passed to properly identify the traffic via the app-id engine.

You really aren't providing any required information to help you here. I can assume that we're talking about a SQL server and this is TCP traffic, but that's just an assumption. Assuming that this is SQL and using TCP, then you would really want to verify in the detailed logs if you are seeing return traffic from the SQL server and ensure the SQL server isn't restricted and is actually responding to the client.

Re: Session Agged out in logs

SumitYadav — Sun, 31 Oct 2021 09:21:56 GMT

if 2 IP addresses are working fine and one has issue then you can check below things:

1. Incomplete message means somehow 3 way handshake is not completed ,check if destination server is receiving packets from your source,

2. check at you firewall if traffic of all three ip address going through same FW policy

3.check tracert and telnet to check reachability to destination

4. check route and also check what interface packet is using to exit firewall.

Do let me know if you require commands to do above steps as well.

Re: Session Agged out in logs

mailmepupun2010 — Sun, 31 Oct 2021 11:17:31 GMT

I will check and back to you.