This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

invalid traffic (from lan to dmz)

Hello, im having issues connecting from my workstation to the webadmin of a freenas storage. I see my attemps marked as invalid traffic, but cant find a reason for it to happen.

I had disabled all options in the corresponding rule: Web malware and content scanning, web control, app control, ips, shapping..

2019-01-22 11:58:22Firewallmessageid="01001" log_type="Firewall" log_component="Invalid Traffic" log_subtype="Denied" status="Deny" con_duration="0" fw_rule_id="0" policy_type="0" user="" user_group="" web_policy_id="0" ips_policy_id="0" appfilter_policy_id="0" app_name="" app_risk="0" app_technology="" app_category="" in_interface="" out_interface="" src_mac="" src_ip="192.168.100.55" src_country="" dst_ip="192.168.99.9" dst_country="" protocol="TCP" src_port="44438" dst_port="443" packets_sent="0" packets_received="0" bytes_sent="0" bytes_received="0" src_trans_ip="" src_trans_port="0" dst_trans_ip="" dst_trans_port="0" src_zone_type="" src_zone="" dst_zone_type="" dst_zone="" con_direction="" con_id="" virt_con_id="" hb_status="No Heartbeat" message="Invalid TCP state." appresolvedby="Signature" app_is_cloud="0"

 

 

my rule is as follows:

 

I also captured a pcap file with rule: host 192.168.99.9 and port 443

captura.tar.gz



This thread was automatically locked due to age.
Parents
  • Hi Lucho,

    It does seem the issue is with the certificate negotiation between the two machines.  Could you please follow this KBA and also check by running this command by using ssh connection  under option 4 > set advanced-firewall tcp-seq-checking off in console and try again. You can re-enable the by running the command  set advanced-firewall tcp-seq-checking on.

Reply
  • Hi Lucho,

    It does seem the issue is with the certificate negotiation between the two machines.  Could you please follow this KBA and also check by running this command by using ssh connection  under option 4 > set advanced-firewall tcp-seq-checking off in console and try again. You can re-enable the by running the command  set advanced-firewall tcp-seq-checking on.

Children