Numerous 'Could not associate packet to any connection.' messages in the firewall log

You can safely ignore them. There are a number of threads on the subject.

Ian

Sorry, I used the search function of the forum but it didn't show any results on the keywords ('associate' for example), manually browsing though the forms indeed showed the other thread. My apologies.

Franc.

If you don't task you don't know, so better to ask and have someone point out it has been asked before.

If in doubt ask, especially in a security forum.

ian

I think it's the same problem as in the first thread:

FW Log "Could not assocate packet to any connection" when IPS enabled

So far there is no solution for that. :-(

There are a lot of could not associate packet to any connection errors in MR7 also. I haven't tested MR8. Its logging related and they need to fix the verbosity along with the actual reason like FIN/RST or whatever the reason the packet was invalid.

I don’t have IPS enabled, but still the errors show up.

Franc.

Likewise, Didnt have IPS enabled, had the error message. Still have the message after IPS enabled too.

I think the errors are related to the web components, e.g. http/s decryption AND web policies. You can try to disable these and check if the errors still occur.

Web filtering isn’t enabled in my setup.

Hi,

Thank you for the feedback.

The logs 'Could not associate packet to any connection.', is generated in following case:

• In case appliance receives any packet, which does not have an already established connection. Hence no associated conntrack is found for that particular packet.
• The connection from the appliance has timed out, but client is still retrying by re-transmitting packets with old connection id.
• This invalid log reason, is not due to any error in appliance or configuration issue. Rather it occurs due to network packets received by appliance for which it has no related connection.

Invalid traffic logging can be turned OFF, to avoid logging these packets frequently.

Earlier this logging was disabled by default, which could be the reason of not noticing these logging.We have enabled "Invalid traffic" logging in SFOSv17 with factory default configuration.

Regards,

Deepti