Loading...
Loading...
Lina doesn't clear the connection even when snort sends "force_block" verdict due to Security Intelligence verdicts. This will result in 302014 syslog events, like: "%FTD-6-302014: Teardown TCP connection 66082 for dmz:iii.jjj.kkk.lll/63284 to outside:xxx.yyy.zzz.www/443 duration 0:00:30 bytes 0 SYN Timeout" "system support trace" output: ####################################### iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=5 ID=0 reputation verdict block from source with list id 1048643 iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=5 ID=0 Packet 111776794: TCP ******S*, 02/05-09:43:42.302611, seq 3120163315, win 65535, options [mss 1460, ws 8, sack OK] dsize 0 iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=5 ID=0 Session: new snort session iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=5 ID=0 Reputation: packet blocked, drop iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=5 ID=0 Event: 136:1:2, Action reject iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=5 ID=0 stream_tcp: session has been dropped iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=5 ID=0 stream_tcp: pending block, drop iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=5 ID=0 Policies: Network 0, Inspection 0, Detection 2 iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=5 ID=0 Verdict: blacklist #######################################
The issue is seen with Security Intelligence traffic block/drops.
None
> system support trace Enable firewall-engine-debug too? [n]: y Please specify an IP protocol: Please specify a client IP address: Please specify a client port: Please specify a server IP address: xxx.yyy.zzz.www Please specify a server port: Monitoring packet tracer and firewall debug messages iii.jjj.kkk.lll 63355 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 reputation verdict block from destination with list id 1048603 iii.jjj.kkk.lll 63355 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Packet 31: TCP ******S*, 03/05-14:17:06.081737, seq 104197103, dsize 0 iii.jjj.kkk.lll 63355 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Session: new snort session iii.jjj.kkk.lll 63355 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Reputation: packet blocked, drop iii.jjj.kkk.lll 63355 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Event: 136:4:2, Action alert iii.jjj.kkk.lll 63355 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Stream: pending block, drop iii.jjj.kkk.lll 63355 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Policies: Network 0, Inspection 0, Detection 7 iii.jjj.kkk.lll 63355 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Verdict: blacklist iii.jjj.kkk.lll 63355 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Verdict Reason: reputation, force_block iii.jjj.kkk.lll 63356 -> xxx.yyy.zzz.www 443 6 AS=0 ID=1 GR=1-1 reputation verdict block from destination with list id 1048603 iii.jjj.kkk.lll 63356 -> xxx.yyy.zzz.www 443 6 AS=0 ID=1 GR=1-1 Packet 28: TCP ******S*, 03/05-14:17:06.081737, seq 2649187384, dsize 0 iii.jjj.kkk.lll 63356 -> xxx.yyy.zzz.www 443 6 AS=0 ID=1 GR=1-1 Session: new snort session iii.jjj.kkk.lll 63356 -> xxx.yyy.zzz.www 443 6 AS=0 ID=1 GR=1-1 Reputation: packet blocked, drop iii.jjj.kkk.lll 63356 -> xxx.yyy.zzz.www 443 6 AS=0 ID=1 GR=1-1 Event: 136:4:2, Action alert iii.jjj.kkk.lll 63356 -> xxx.yyy.zzz.www 443 6 AS=0 ID=1 GR=1-1 Stream: pending block, drop iii.jjj.kkk.lll 63356 -> xxx.yyy.zzz.www 443 6 AS=0 ID=1 GR=1-1 Policies: Network 0, Inspection 0, Detection 7 iii.jjj.kkk.lll 63356 -> xxx.yyy.zzz.www 443 6 AS=0 ID=1 GR=1-1 Verdict: blacklist iii.jjj.kkk.lll 63356 -> xxx.yyy.zzz.www 443 6 AS=0 ID=1 GR=1-1 Verdict Reason: reputation, force_block iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 reputation verdict block from destination with list id 1048603 iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Packet 32: TCP ******S*, 03/05-14:17:06.341718, seq 544140654, dsize 0 iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Session: new snort session iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Reputation: packet blocked, drop iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Event: 136:4:2, Action alert iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Stream: pending block, drop iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Policies: Network 0, Inspection 0, Detection 7 iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Verdict: blacklist iii.jjj.kkk.lll 63357 -> xxx.yyy.zzz.www 443 6 AS=0 ID=0 GR=1-1 Verdict Reason: reputation, force_block vFTD741-A# sh conn addr xxx.yyy.zzz.www 25 in use, 87 most used Inspect Snort: preserve-connection: 14 enabled, 0 in effect, 47 most enabled, 4 most in effect TCP dmz aaa.bbb.ccc.ddd(iii.jjj.kkk.lll):63356 outside xxx.yyy.zzz.www:443, idle 0:00:29, bytes 0, flags xaA N TCP dmz aaa.bbb.ccc.ddd(iii.jjj.kkk.lll):63355 outside xxx.yyy.zzz.www:443, idle 0:00:29, bytes 0, flags xaA N TCP dmz aaa.bbb.ccc.ddd(iii.jjj.kkk.lll):63357 outside xxx.yyy.zzz.www:443, idle 0:00:29, bytes 0, flags xaA N vFTD741-A# vFTD741-A# sh conn addr xxx.yyy.zzz.www 23 in use, 87 most used Inspect Snort: preserve-connection: 15 enabled, 0 in effect, 47 most enabled, 4 most in effect vFTD741-A# sh log | in xxx.yyy.zzz.www %FTD-6-302013: Built inbound TCP connection 66082 for dmz:iii.jjj.kkk.lll/63284 (aaa.bbb.ccc.ddd/63284) to outside:xxx.yyy.zzz.www/443 (xxx.yyy.zzz.www/443) %FTD-6-302013: Built inbound TCP connection 66083 for dmz:iii.jjj.kkk.lll/63285 (aaa.bbb.ccc.ddd/63285) to outside:xxx.yyy.zzz.www/443 (xxx.yyy.zzz.www/443) %FTD-6-302013: Built inbound TCP connection 66085 for dmz:iii.jjj.kkk.lll/63287 (aaa.bbb.ccc.ddd/63287) to outside:xxx.yyy.zzz.www/443 (xxx.yyy.zzz.www/443) %FTD-6-302014: Teardown TCP connection 66082 for dmz:iii.jjj.kkk.lll/63284 to outside:xxx.yyy.zzz.www/443 duration 0:00:30 bytes 0 SYN Timeout %FTD-6-302014: Teardown TCP connection 66083 for dmz:iii.jjj.kkk.lll/63285 to outside:xxx.yyy.zzz.www/443 duration 0:00:30 bytes 0 SYN Timeout %FTD-6-302014: Teardown TCP connection 66085 for dmz:iii.jjj.kkk.lll/63287 to outside:xxx.yyy.zzz.www/443 duration 0:00:30 bytes 0 SYN Timeout
Cisco Integration
Learn more about where this data comes from
BugZero Plan
Streamline upgrades with automated vendor bug scrubs
BugZero Prevent
Wish you caught this bug sooner? Get proactive today.