I've setup an WAF with UTM 9 with a virtual server two real servers with some applications in a private network behind it (real server 1 has IP 10.200.3.10 on port 443/HTTPS and server 2 has IP 10.200.3.11 on port 80/HTTP). The UTM has the IP address 10.200.3.1 in this private network.
Everything seems working perfectly, I can access both applications and cannot see and problems, but the Firewall keeps logging drop messages that seem somehow strange to me - e.g.
22:08:49 Default DROP TCP 10.200.3.10 : 443 → 10.200.3.1 : 49249 [ACK PSH] len=153 ttl=128 tos=0x00
22:08:49 Default DROP TCP 10.200.3.10 : 443 → 10.200.3.1 : 49249 [ACK FIN] len=52 ttl=128 tos=0x00
22:08:49 Default DROP TCP 10.200.3.10 : 443 → 10.200.3.1 : 49249 [ACK PSH FIN] len=153 ttl=128 tos=0x00
22:08:49 Default DROP TCP 10.200.3.10 : 443 → 10.200.3.1 : 49249 [ACK PSH FIN] len=153 ttl=128 tos=0x00
22:08:51 Default DROP TCP 10.200.3.10 : 443 → 10.200.3.1 : 49249 [ACK PSH FIN] len=153 ttl=128 tos=0x00
22:08:52 Default DROP TCP 10.200.3.10 : 443 → 10.200.3.1 : 49249 [ACK PSH FIN] len=153 ttl=128 tos=0x00
22:08:53 Default DROP TCP 10.200.3.10 : 443 → 10.200.3.1 : 49249 [ACK PSH FIN] len=153 ttl=128 tos=0x00
22:08:56 Default DROP TCP 10.200.3.10 : 443 → 10.200.3.1 : 49249 [ACK PSH FIN] len=153 ttl=128 tos=0x00
22:09:01 Default DROP TCP 10.200.3.10 : 443 → 10.200.3.1 : 49249 [ACK PSH FIN] len=153 ttl=128 tos=0x00
22:09:02 Default DROP TCP 10.200.3.10 : 443 → 10.200.3.1 : 49249 [ACK RST] len=40 ttl=128 tos=0x00
and then the same repeats with another (random) destination port number on 10.200.3.1, and I get similar messages from source port 80 on 10.200.3.11.
As far as I understand it the packet filter somehow misinterprets a standing TCP connection from "itself" (i.e. the WAF) to the "real" webserver as hostile at some point and drops the connection - but it seems that this does not affect the applications itself, so probably it's in the end phase of the connection.
Nevertheless the messages are annoying and giving a wrong picture in the firewall logs and statistics, so I'd like to get rid of them - anybody knows what's going on here?
thanks and br,
__
/homas Bleier
This thread was automatically locked due to age.
