Thread Info
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Invalid Traffic / Invalid TCP state (no routing issue)

Gerhard Sauer

Hello,
I have a problem with mainly HTTPS connections showing up in the log as Invalid Traffic / Invalid TCP state. See screenshots below.

example domain is https://telekom.de

I have 2 Internet connections with separate NAT and SD-WAN routes. Routing shows correctly and see workaround below, works for both lines, if TCP Seq Checking is disabled.

So there seems to be an issue with TCP checking not routing. Especially, because most websites do work, even if it is turned on.

Interesting to mention, both internet connections are with the same provider and run through the same router. 1 I checked with packet capturing multiple times, that no routing issue persist. Many connections do work, but with the example of telekom.de it does not work at all on the second line... But if TCP Seq checking is on, the second line works in many cases nevertheless. Packet capture also shows no other packets being delivered somewhere else.

The 80... IP is telekom.de and both internet connections are internally rereferred to as 192.168.12.12 or 192.168.10.10

Current work around is to disable "TCP Seq Checking", then it works.

Issue persists with 

SFOS 21.0.0 GA-Build169

and

SFOS 20.0.2 MR-2-Build378

Is something like this a known issue?

How can this be troubleshootet further?

Thank you.



This thread was automatically locked due to age.
  • 0

    How is your WAN Gateway setup? both lines active or one standby? Does the same happen when only one line is disconnected or disabled?

    First thought is about a asynchronous routing issue but you'd need to dump the traffic on CLI for each in and out interface and see where the packets are actually going.

    Incoming packets seem to match no active tcp connection - thus being dropped.

    Also cli tool drppkt may be helpful du analyze.

    I suspect that the traffic is at least in parts going over different interfaces.

    • 0 in reply to LHerzog

      both wan gateways are active and not on standby.

      The same happens, when I disable the first internet connection.

      each internet connection uses an own physical ethernet cable and own IP range. SD WAN routing and NAT routing applies to the machines.

    • 0

      Just to be sure: Do you have any kind of Issue or is it only about the "invalid traffic" Logging? 

      __________________________________________________________________________________________________________________

    Unfiltered HTML