Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Replies 2 replies
  • Subscribers 41 subscribers
  • Views 81 views
  • Users 0 members are here
Options
Suggested

Invalid Traffic / Invalid TCP state (no routing issue)

Gerhard Sauer

Hello,
I have a problem with mainly HTTPS connections showing up in the log as Invalid Traffic / Invalid TCP state. See screenshots below.

example domain is https://telekom.de

I have 2 Internet connections with separate NAT and SD-WAN routes. Routing shows correctly and see workaround below, works for both lines, if TCP Seq Checking is disabled.

So there seems to be an issue with TCP checking not routing. Especially, because most websites do work, even if it is turned on.

Interesting to mention, both internet connections are with the same provider and run through the same router. 1 I checked with packet capturing multiple times, that no routing issue persist. Many connections do work, but with the example of telekom.de it does not work at all on the second line... But if TCP Seq checking is on, the second line works in many cases nevertheless. Packet capture also shows no other packets being delivered somewhere else.

The 80... IP is telekom.de and both internet connections are internally rereferred to as 192.168.12.12 or 192.168.10.10

Current work around is to disable "TCP Seq Checking", then it works.

Issue persists with 

SFOS 21.0.0 GA-Build169

and

SFOS 20.0.2 MR-2-Build378

Is something like this a known issue?

How can this be troubleshootet further?

Thank you.



Added TAGs
[edited by: Erick Jan at 12:45 AM (GMT -8) on 22 Nov 2024]
Parents
  • 0

    How is your WAN Gateway setup? both lines active or one standby? Does the same happen when only one line is disconnected or disabled?

    First thought is about a asynchronous routing issue but you'd need to dump the traffic on CLI for each in and out interface and see where the packets are actually going.

    Incoming packets seem to match no active tcp connection - thus being dropped.

    Also cli tool drppkt may be helpful du analyze.

    I suspect that the traffic is at least in parts going over different interfaces.

Reply
  • 0

    How is your WAN Gateway setup? both lines active or one standby? Does the same happen when only one line is disconnected or disabled?

    First thought is about a asynchronous routing issue but you'd need to dump the traffic on CLI for each in and out interface and see where the packets are actually going.

    Incoming packets seem to match no active tcp connection - thus being dropped.

    Also cli tool drppkt may be helpful du analyze.

    I suspect that the traffic is at least in parts going over different interfaces.

Children
No Data
Unfiltered HTML