0

we have some customer complains regarding a flow between a DB and Server crossing our FW. It involved 2 DB and several Servers, there are 2 VLANs connected to same FW.

When failover to FW-2, we noticed a lot of TCP-RESET (it takes arround 18/19 between RESET and last frame, you can give a look to delta time in my screenshot. In 2 min, arround 220 RESET.

It can happen suddendly, after 2 o 10 o 20 seconds, then DB o server send a TCP-RESET (TCP-RESET-ACK is received first as it looks like that's miss-ordered from my point of view).

Captures has been done on FW interface side... (I guess that should be better to have from DB and server side also...)

When running on FW-1, situation is OK, we didn't notice any TCP-RESET into the packet capture.

enter image description here

1 Answer 1

1

When failover to FW-2, ...

Assuming the firewall are in a simple fail-over scheme with VRRP or similar, that is to be expected.

A firewall is usually stateful, ie. it tracks the connections states for everything running across. Packets not matching the tracked state are dropped.

Since FW-2 doesn't know about any connections established over FW-1 before failing over, FW-2 resets all currently running connections as they're out of state from its perspective. New connections shouldn't be a problem though.

If that is not as desired, you need to either use firewalls that permanently synchronize states from active to standby, or to deactivate state tracking altogether. How either can be accomplished depends on your device types/models.

If you think that you have already configured everything that way, please add the device configurations to your question (using the editor's {} function).

3
  • Thanks for your feedback Zack67, it could make sense but take in count that FW has been already failover and all traffic is going through FW-2 since few minutes. 3-ways-handshake are properly established for all TCP sessions and then suddendly a TCP-RESET pop from Server or BD...
    – Robz2113
    Jun 30 at 13:38
  • Depending on how those traffic flows work, the RSTs can at least potentially belong to connections established across the failed firewall. Making sure of whether or not that is the case requires deeper analysis (tracking before failover and trying to match the RST connections).
    – Zac67
    Jun 30 at 14:42
  • Thanks sir, I will ask for another windows to failover FW and check this ;)
    – Robz2113
    Jul 1 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.