Wednesday, August 4, 2021

Cisco ASA log message "SFR requested device to bypass further packet redirection and process TCP flow from.."

Hello all,

Im trying to open port 443 between two servers and I cant make it work. I looked at the log messages and this is what I found:

Aug 04 2021 14:48:13: %ASA-6-434004: SFR requested device to bypass further packet redirection and process TCP flow from INTERFACE-A:10.150.150.10/443 to INTERFACE-B:10.40.10.10/49759 locally

Aug 04 2021 14:49:00: %ASA-6-106015: Deny TCP (no connection) from 10.40.10.10/49761 to 10.233.60.132/8080 flags RST on interface *******

Aug 04 2021 14:49:00: %ASA-6-106015: Deny TCP (no connection) from 10.233.60.132/8080 to 10.40.10.10/49760 flags ACK on interface *****-PROXY

Aug 04 2021 14:49:00: %ASA-6-106015: Deny TCP (no connection) from 10.233.60.132/8080 to 10.40.10.10/49761 flags ACK on interface *******-PROXY

I have an access rule that is permitting source IP 10.40.10.10 to destination 10.250.250.50 on port 443.

access-list ACL-PROD extended permit tcp host 10.40.10.10 host 10.250.250.50 eq https.

I cant see in the logs that the IP 10.40.10.10 is even trying to make a TCP connection with 10.250.250.50.

I have double checked that the ACL is applied to the right interface and we have routing.

Our windows guys checked the proxy and they opened ports (just for now) to make some tests. They could se all 10. IP addresses bypass in the proxy.

Could someone explain to me what the log message "SFR requested device to bypass further packet redirection and process TCP flow from..." and what could cause this problem?

Thanks!



No comments:

Post a Comment