Could not associate packet to any connection.

Hi Karim Toumi ,

Good day and thanks for reaching out to Sophos Community and hope you are well

Are there any users that can successfully connect to the server? If yes, Do they traverse on the same FW rule?

You may refer to these articles and guides when an Invalid traffic is encountered:

Recommended Read (Invalid Traffic):  Sophos Firewall: Invalid Traffic 

Invalid Traffic Events Doc guide: https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Logs/LogViewer/InvalidTrafficEvents/index.html

Cheers,

Hi;

Yes, the same thing for all users, they suffer from packet lost, and they traverse on the same FW rule.

The problem is they connect to the server normally, and make a transaction, but suddenly the connection lost (loading in progress display odoo interface) and when I search for log viewer I found the user was blocked 'denied' like mentioned in the previous capture

Hi,

please post a copy of the network setup of your firewall rule. Invalid traffic is usually ignored by turning off the logging of invalid packets. The issue sounds more like a network configuration in the server rather than the firewall.

Ian

Right, Invalid traffic is, as I understand it, traffic that's sent from the far end after a connection is closed and thus it's invalid. So if the client is closing the connection on the server (could be endpoint, I guess) but the server is still sending packets, they would be invalid. And I guess if the server closed the connection but the clients were still sending packets, that would also be.

From the screen capture if the clients are 192.168.X.X, it appears that it's the latter case: server has closed connection but clients still sending packets. But I am a little confused and it could be the other way around.

Right, Invalid traffic is, as I understand it, traffic that's sent from the far end after a connection is closed and thus it's invalid. So if the client is closing the connection on the server (could be endpoint, I guess) but the server is still sending packets, they would be invalid. And I guess if the server closed the connection but the clients were still sending packets, that would also be.

From the screen capture if the clients are 192.168.X.X, it appears that it's the latter case: server has closed connection but clients still sending packets. But I am a little confused and it could be the other way around.