TCP:SAE
-
Hello,
i am running into TCP:SAE issus with my network and dont have any ideas how to proceed on it / ran out of ideas.
Firewall log says:
Default deny rule IPv4 (10000000103)
source: ip:8009
destination: ip:56473
protocol: TCP:SAEappreciate some help or tips.
-
@kojol A syn,ack block points to asymmetrical traffic flow..
S = SYN
A = ACK
E = ECE -
thank your for replying to my post.
"In asymmetric routing scenarios, there is an option in the firewall GUI which can be used to prevent legitimate traffic from being dropped"
--> this is already in place
-
@kojol Why would your traffic be asymmetrical.. That is your problem - fix the asymmetrical flow..
So I take it your client is 10.3 and he is sending his syn to this 10.2 box on port 8009 - but that did not flow through pfsense, if it did pfsense would create a state and allow the return traffic (syn,ack).
You have a masking problem, you have common L2?
When you create segmentation in your network, traffic should flow through pfsense in both directions. If pfsense sees some syn,ack and it never saw the syn to open the state then yeah your traffic would be blocked.
If your segments are properly isolated there should be no way possible for 10.3 to talk to your other segment at 10.2 without flowing through pfsense. And same goes for the return traffic.
Do have a common L2 network, and a mismatch mask.. Where your client on 10.3 thinks 10.2 is on its network and just sends the traffic there directly. But your device on 10.2 thinks 10.3 is a different network so sends its reply (sa) to pfsense..
