This article describes the issue of the firewall dropping packets due to no existing sessions; this is due to the session being open on the client and the server sending non-syn packets.

A customer is complaining that he is not able to connect to the server using a application. Running a debug, we see that the firewall is receiving non-syn data packets and these packets are getting dropped due to 'no existing session found and stating that packet have been dropped; first pak not sync'.

Disabling TCP SYN check and sequence check resolves the issue.

This can occur in the following scenarios:

1. When we manually clear the session from the firewall, the application and server are not aware that the session has been closed. They keep on re-transmitting data packets.


2. When the timeout value for different protocols is different in the client server and firewall. For example, the protocol timeout value for TCP is set to 1 hour; but the firewall, following RFC, only maintains it for 30 minutes. After 30 minutes of idle timeout, the firewall will close the session. But the client or server may transmit data packets as the session on the client and server is still open.

Make sure the set zone zone_name tcp-rst command is enabled, so that when the firewall is receiving a non-syn packet for the non-existing session, the device drops the segment, notifies the initiator to reset the TCP connection, and does not create a new session (If the device does not send a RESET notice, the initiator repeatedly sends the same TCP segment until the connection attempt times out.). Alternatively, we need to clear the session manually on the client and server.