This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Could not associate packet to any connection

Steffen Hoock over 7 years ago

Hi,

i have a XG with small Firewall Rules !

I use NOT:

- IPS
- or any Security Setting

I work only Business Rules to our Servers (Port 80,443...)

I have every day a complete down from firewall and the Log say "Could not associate packet to any connection."

2018-01-30 11:10:15Firewallmessageid="01001" log_type="Firewall" log_component="Invalid Traffic" log_subtype="Denied" status="Deny" con_duration="0" fw_rule_id="0" policy_type="0" user="" user_group="" web_policy_id="0" ips_policy_id="0" appfilter_policy_id="0" app_name="" app_risk="0" app_technology="" app_category="" in_interface="PortB" out_interface="" src_mac="" src_ip="xxxx" src_country="" dst_ip="xxxx" dst_country="" protocol="TCP" src_port="39228" dst_port="22" packets_sent="0" packets_received="0" bytes_sent="0" bytes_received="0" src_trans_ip="" src_trans_port="0" dst_trans_ip="" dst_trans_port="0" src_zone_type="" src_zone="" dst_zone_type="" dst_zone="" con_direction="" con_id="" virt_con_id="" hb_status="No Heartbeat" message="Could not associate packet to any connection." appresolvedby="Signature"

Can any help, the sophos case support is a disaster nobody have intresst to work with my case.

thx in advance

This thread was automatically locked due to age.

0 rfcat_vk over 7 years ago

Hi,

it is not a case as was cleared up during the beta of v17. A number of people have raised this issue what appears to have happened is during the build of v17 sophos increased the logging details, personally I don't think it was a good idea because you get to see a lot of junk information which you can't do anything about.

Basically it it the firewall doing it job of blocking dropped or failed connections. If you have logged a case then a clarifying explanation should have followed from support in my opinion.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 ThibautVan der Kluft over 7 years ago

Hello Steffen,

The message "Could not associate packet to any connection." means, most of the time, that the packet is for an expired connection. For example, you opened a connection to a server with SSH and you have internet fluctuation on the Client side, so the XG Firewall will not see any traffic for that connection for some time and it will consider it as expired. This is something that happens quite often in real world situation and most of the time you would not have to worry about those logs.
Cancel
Vote Up 0 Vote Down

Cancel
0 Steffen Hoock over 7 years ago in reply to rfcat_vk

I understand what you mean.

But the message "Could not associate packet to any connection" block every Day my complete Traffic. Only then i have
only Access on Firewall. The rest is Dead.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 7 years ago in reply to Steffen Hoock

Hi,

seems the appliance flushs your Conntrack..

When this happens, can you enable a new connection or is your current connection gone?

Do you see a time pattern? Do you use STAS and it only happens with network / user policies?

Cheers
Cancel
Vote Up 0 Vote Down

Cancel
0 Steffen Hoock over 7 years ago in reply to LuCar Toni

you can see the screenshots from yersterday
Cancel
Vote Up 0 Vote Down

Cancel
0 Steffen Hoock over 7 years ago in reply to Steffen Hoock
Cancel
Vote Up 0 Vote Down

Cancel
0 Steffen Hoock over 7 years ago in reply to LuCar Toni

No i Use not STAS
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 7 years ago in reply to Steffen Hoock

Mh, can you give us a overview of this setup?

Like mention before: external : internal connections?

These drops seems to be related to DNAT / WAF connections?

Do you use STAS?

Do you use network or user policies?
Cancel
Vote Up 0 Vote Down

Cancel
0 Steffen Hoock over 7 years ago in reply to LuCar Toni

I use no

STAS

i use Business polices an 4 default firewall rules.

I habe yesterday on the problem the rules switch to all traffic draft ...self problem
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to Steffen Hoock

Hi,

the other thing to look at is your external network connection, if it is failing you will see lots of traffic similar to what you are investigating.

Ian
Cancel
Vote Up 0 Vote Down

Cancel