Teardown tcp connection что означает
Я впервые столкнулся с CISCO PIX 515, хочу на нем сделать DMZ.
Управляю через PDM, вроде бы ничего такого не настраивал, только самое необходимое. При коннекте из внутренней сети на машину в DMZ в логе пишет сначала
Nov 17 12:56:07 10.60.33.26 PIX-6-302013RealSource:»10.60.33.26″ Nov 17 2003 13:06:49: %PIX-6-302013: Built outbound TCP connection 162 for dmz:10.50.0.42/110 (10.50.0.42/110) to inside:10.60.33.60/4255 (10.60.33.60/4255)
а потом
Nov 17 12:56:07 10.60.33.26 PIX-6-302014RealSource:»10.60.33.26″ Nov 17 2003 13:06:49: %PIX-6-302014: Teardown TCP connection 162 for dmz:10.50.0.42/110 to inside:10.60.33.60/4255 duration 0:00:01 bytes 100 TCP FINsСоответственно коннект рвется.
Не подскажете в двух словах, где искать?
Заранее спасибо!
-
, ВОЛКА, 19:30 , 17-Ноя-03, (1)
-
, Den, 17:33 , 19-Ноя-03, (2)
-
, ВОЛКА, 22:41 , 19-Ноя-03, (3)
-
, Den, 09:05 , 20-Ноя-03, (4)
Показываю:
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
interface ethernet3 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security15
nameif ethernet3 pix/intf3 security15
enable password uBsOjijurAEZFM7c encrypted
passwd h4vMmAV6UI3wICj/ encrypted
hostname host
domain-name host.ru
clock timezone MSK/MSD 3
clock summer-time MSK/MDD recurring last Sun Mar 2:00 last Sun Oct 3:00
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list ICMP permit icmp any any
access-list inside_access_in permit ip any any log 7 interval 10
access-list dmz_access_in permit ip any any log 7 interval 10
pager lines 24
logging on
logging timestamp
logging trap debugging
logging facility 23
logging host inside 10.60.33.60
icmp permit any outside
icmp permit any inside
icmp permit any dmz
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu pix/intf3 1500
ip address outside 10.1.0.2 255.255.255.252
ip address inside 10.60.33.26 255.255.255.0
ip address dmz 10.50.0.1 255.255.255.0
ip address pix/intf3 10.30.30.30 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address dmz
no failover ip address pix/intf3
pdm location 10.60.1.0 255.255.255.0 pix/intf3
pdm location 10.100.0.108 255.255.255.255 pix/intf3
pdm location 10.60.33.0 255.255.255.0 inside
pdm location 10.60.33.60 255.255.255.255 inside
no pdm history enable
arp timeout 14400
static (inside,dmz) 10.50.0.42 10.60.33.60 netmask 255.255.255.255 0 0
access-group inside_access_in in interface inside
access-group dmz_access_in in interface dmz
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
aaa authentication secure-http-client
http server enable
http 10.60.33.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection tcpmss 0
telnet 10.60.33.0 255.255.255.0 inside
telnet timeout 15
ssh timeout 5
console timeout 0
username marat password 45W6njenyVAPlJYd encrypted privilege 15
terminal width 80
Cryptochecksum:8813f393d6c053d25270dce391c69931
>nat (inside) 0 access-list NO-NAT
>access-list NO-NAT permit ip any 10.50.0.0 255.255.255.0
Это вместо существующих правил или добавить?Если добавляю, то ситуация не меняется
teardown connection
закрытие соединения — завершение соединения — [Л.Г.Суменко. Англо русский словарь по информационным технологиям. М.: ГП ЦНИИС, 2003.] Тематики информационные технологии в целом Синонимы завершение соединения EN teardown connectionconnection release … Справочник технического переводчика
iPad — This article is about the line of tablet computers designed and marketed by Apple Inc. For other uses, see iPad (disambiguation). iPad An iPad showing … Wikipedia
iPod Touch — Black 4th generation iPod Touch Developer Apple Inc … Wikipedia
iPhone — This article is about the line of smartphones by Apple. For other uses, see iPhone (disambiguation). The iPhone 4S, the most recent generation of the iPhone iPhone models … Wikipedia
iPhone 4 — iPhone 4 … Wikipedia
Bluetooth — This article is about the electronic protocol. For the medieval King of Denmark, see Harald I of Denmark. Bluetooth logo Bluetooth is a proprietary open wireless technology standard for exchanging data over short distances (using short wavelength … Wikipedia
iPad — У этого термина существуют и другие значения, см. iPad (значения). Не следует путать с iPod. iPad Производител … Википедия
IPad — У этого термина существуют и другие значения, см. IPad (значения). iPad Производитель Foxconn[1] … Википедия
iPod Nano — Apple s 6th Generation iPod Nano Developer Apple Inc. Manufacturer Foxconn Retail availability … Wikipedia
Space Hulk — infobox game image link = image caption = Cover of the first edition of Space Hulk designer = Dean Bass manufacturer = Games Workshop publisher = Games Workshop illustrator = years = players = ages = setup time = playing time = random chance =… … Wikipedia
Nokia N8 — The Nokia N8 is the first device to run on the Symbian^3 mobile operating system. Manufacturer Nokia Series Nseries … Wikipedia
ASA TCP Connection Flags (Connection Build-Up and Teardown)
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Contents
Introduction
This document provides information about Adaptive Security Appliance (ASA) TCP connection flags.
Prerequisites
Requirements
Cisco recommends that you have knowledge of these topics:
Basic knowledge of the TCP Communications Protocol
Basic knowledge of the ASA CLI
Components Used
The information in this document is based on ASA version 8.4.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
ASA TCP Connection Flags
When you troubleshoot TCP connections through the Adaptive Security Appliance (ASA), the connection flags shown for each TCP connection provide a wealth of information about the state of TCP connections to the ASA. This information can be used to troubleshoot problems with the ASA, as well as problems elsewhere in the network.
Here is the output of the show conn protocol tcp command, which shows the state of all TCP connections through the ASA. These connections can also be seen with the show conn command.
The next picture shows the ASA TCP Connection flags at different stages of the TCP state machine. The connection flags can be seen with the show conn command on the ASA.
TCP Connection Flag Values
Additionally, in order to view all of the possible connection flags issue the show connection detail command on the command-line:
