CCSM Advanced Firewall Troubleshooting — All Questions With Answers

Kernel: [fw4_0];[cpu_0];fw_log_drop: Packet dropped by fw_log_drop_reason: Out of state packet (reason: TCP RST after FIN);

fw ctl pstat
Status: Active
Load: 15%
Packets per second: 1200
Dropped packets: 450
SecureXL: Enabled
Acceleration: Enabled
F2P: Enabled
VSX: Disabled

FW_DEBUG_01: [tid_0];[cpu_0]; fw_filter_inspect: packet arrived
FW_DEBUG_01: [tid_0];[cpu_0]; fw_xlate_packet: packet translated
FW_DEBUG_01: [tid_0];[cpu_0]; fw_conn_post_inspect: connection dropped

fw ctl pstat output shows: 250000 concurrent connections. Memory usage: 98%. System load: 4.5.

Output of fw ctl zdebug drop:
[cpu_0];[fw4_0];fw_log_drop_conn: Packet dropped because of violation of stateful inspection (out of state);

Packet log: 10.1.1.5 -> 10.2.2.5, Action: Drop, Reason: Cleanup rule, Interface: eth0, Security Gateway: GW1

fw ctl multik stat output:
Worker 0: 45% load
Worker 1: 95% load
Worker 2: 12% load
Worker 3: 10% load

Output of 'fw ctl pstat':
Connection rate: 1500/sec
Connection table: 250,000 / 250,000

Global Properties -> Inspection Settings -> Malicious Code -> 'Drop packets that do not match the protocol definition' = Enabled

fw ctl debug -m fw + drop
fw ctl debug -m fw + xlate
fw ctl debug -m fw + conn

Error: 'Connection table is full' in logs.

Packet flow from 10.1.1.1 to 10.2.2.2 is blocked. FW monitor shows: 'i' (inbound) capture, but no 'o' (outbound) capture.

Config: Interface eth0 set to 'External'. Topology: 'External'. Traffic Source: 192.168.1.5 (Internal IP).