Session Agged out in logs

[mailmepupun2010]

Hi Team,

need your support on my issue aged out and incomplet application for port 1433.

However, the policy is allow.

Need how to fix this..

Same subnet other two IPs working find ,But one of the IP is agged out

[BPry]

aged-out just means the firewall never gets a RST or FIN on TCP packets, or is common and expected on UDP traffic. Incomplete just means that not enough traffic passed to properly identify the traffic via the app-id engine. 

You really aren't providing any required information to help you here. I can assume that we're talking about a SQL server and this is TCP traffic, but that's just an assumption. Assuming that this is SQL and using TCP, then you would really want to verify in the detailed logs if you are seeing return traffic from the SQL server and ensure the SQL server isn't restricted and is actually responding to the client. 

[SumitYadav]

if 2  IP addresses are working fine and one has issue then you can check below things:

1. Incomplete message means somehow 3 way handshake is not completed ,check if destination server is receiving packets from your source, 

2. check at you firewall if traffic of all three ip address  going through same FW policy

3.check tracert and telnet to check reachability to destination

4. check route and also check what interface packet is using to exit firewall.

Do let me know if you require commands to do above steps as well.

3. 

[mailmepupun2010]

I will check and back to you.