This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Could not associate packet to any connection

Steffen Hoock over 7 years ago

Hi,

i have a XG with small Firewall Rules !

I use NOT:

- IPS
- or any Security Setting

I work only Business Rules to our Servers (Port 80,443...)

I have every day a complete down from firewall and the Log say "Could not associate packet to any connection."

2018-01-30 11:10:15Firewallmessageid="01001" log_type="Firewall" log_component="Invalid Traffic" log_subtype="Denied" status="Deny" con_duration="0" fw_rule_id="0" policy_type="0" user="" user_group="" web_policy_id="0" ips_policy_id="0" appfilter_policy_id="0" app_name="" app_risk="0" app_technology="" app_category="" in_interface="PortB" out_interface="" src_mac="" src_ip="xxxx" src_country="" dst_ip="xxxx" dst_country="" protocol="TCP" src_port="39228" dst_port="22" packets_sent="0" packets_received="0" bytes_sent="0" bytes_received="0" src_trans_ip="" src_trans_port="0" dst_trans_ip="" dst_trans_port="0" src_zone_type="" src_zone="" dst_zone_type="" dst_zone="" con_direction="" con_id="" virt_con_id="" hb_status="No Heartbeat" message="Could not associate packet to any connection." appresolvedby="Signature"

Can any help, the sophos case support is a disaster nobody have intresst to work with my case.

thx in advance

This thread was automatically locked due to age.

Parents

0 rfcat_vk over 7 years ago

Hi,

it is not a case as was cleared up during the beta of v17. A number of people have raised this issue what appears to have happened is during the build of v17 sophos increased the logging details, personally I don't think it was a good idea because you get to see a lot of junk information which you can't do anything about.

Basically it it the firewall doing it job of blocking dropped or failed connections. If you have logged a case then a clarifying explanation should have followed from support in my opinion.

Ian

XG115W - v19.5.1 mr-1 - Home

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Steffen Hoock over 7 years ago in reply to rfcat_vk

I understand what you mean.

But the message "Could not associate packet to any connection" block every Day my complete Traffic. Only then i have
only Access on Firewall. The rest is Dead.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 7 years ago in reply to Steffen Hoock

Hi,

seems the appliance flushs your Conntrack..

When this happens, can you enable a new connection or is your current connection gone?

Do you see a time pattern? Do you use STAS and it only happens with network / user policies?

Cheers

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Steffen Hoock over 7 years ago in reply to LuCar Toni

you can see the screenshots from yersterday
Cancel
Vote Up 0 Vote Down

Cancel
0 Steffen Hoock over 7 years ago in reply to Steffen Hoock
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Steffen Hoock over 7 years ago in reply to Steffen Hoock
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 LuCar Toni over 7 years ago in reply to Steffen Hoock

Mh, can you give us a overview of this setup?

Like mention before: external : internal connections?

These drops seems to be related to DNAT / WAF connections?

Do you use STAS?

Do you use network or user policies?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel
0 Steffen Hoock over 7 years ago in reply to LuCar Toni

I use no

STAS

i use Business polices an 4 default firewall rules.

I habe yesterday on the problem the rules switch to all traffic draft ...self problem
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to Steffen Hoock

Hi,

the other thing to look at is your external network connection, if it is failing you will see lots of traffic similar to what you are investigating.

Ian

XG115W - v19.5.1 mr-1 - Home

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 RyanDonohue over 7 years ago in reply to rfcat_vk

Did you get this figured out? I'm having the same issue, but only in one zone, and on one firewall. I have a second XG with nearly identical settings that does not have the issue. Mine happens on a per device basis though, instead of all traffic. If I disconnect the device and reconnect everything is happy again. When this starts happening the XG drops all of the users traffic.
Cancel
Vote Up 0 Vote Down

Cancel