topic Re: what is the meaning of "tcp client reset via TCP responding rst" output in global counter in General Topics

what is the meaning of "tcp client reset via TCP responding rst" output in global counter

Deepak_K — Tue, 23 Mar 2021 15:44:48 GMT

We are not able to connect VPN hosted in vpn_dmz zone.

We have deployed third party vpn in vpn_dmz zone and configured inbound nat for same.

Its old setup , all of sudden we are unable to connect vpn intermittently.

did pcap for vpn public ip , showing below counter after running "show counter global filter packet-filter yes delta yes severity drop" command

tcp client reset via TCP responding rst:

Re: what is the meaning of "tcp client reset via TCP responding rst" output in global counter

S.Cantwell — Tue, 23 Mar 2021 17:12:10 GMT

Howdy

I would interpret this to mean that the Srv side of the VPN reset the connection,and likewise, the client side reset its side of the TCP connection. But I think you are getting perhaps a little too deep in analysis.

What is the current status of your VPN? It is up or not?

If it is not up, run a "clear vpn flow", followed by "test vpn ike-sa", then "test vpn ipsec-sa", and then look at your System Logs for the output on the responses to these commands. One side needs to initiate the vpn, and the other side needs to respond. What do you see in your logs.

Presuming that ipsec and ike are allowed by a security policy, you should get some response/details about what is going on.

Can you get the remote (non PAN) to initiate the VPN and you again at logs on your PANW FW.

I do not personally think it is necessary to look at global counters. If packets are going to be dropped,you would see the session in the Session Browser or the Traffic Logs.

Thanks

Re: what is the meaning of "tcp client reset via TCP responding rst" output in global counter

Deepak_K — Tue, 23 Mar 2021 18:12:46 GMT

@S.Cantwell

We have deployed F5 vpn , we were unable to connect sslvpn intermittently. This issue happened first time.

In traffic logs , session end reason for some logs were tcp-fin and for some it was tcp-rst-frm-client

Re: what is the meaning of "tcp client reset via TCP responding rst" output in global counter

S.Cantwell — Tue, 23 Mar 2021 18:28:06 GMT

Hi there

Again, we are getting closer. 😛

Instead of looking at traffic logs, let's see why your VPN is not being established.

Could you copy/paste the logs from your System logs, with a "subtype eq vpn"

We would normally expect Phase1 (ike) and phase2 (IPsec) to be negotiated and those negotiations logs are found in System.

tcp-fin means that the session closed by a FIN packet. Unless you can provide visual information, it may be hard to explain what/why/how this is not working as expected.

Thanks