Guest

Preview Tool

Cisco Bug: CSCuq80704 - ASA classifies TCP packets as PAWS failure incorrectly

Last Modified

Apr 25, 2019

Products (1)

  • Cisco ASA 5500-X Series Firewalls

Known Affected Releases

9.1(5) 9.4(3) 9.4(3.4) 9.6(1)

Description (partial) 

Symptom:
The ASA may incorrectly classify some TCP segments as failing a PAWS test when the TS.value present in the tcp header wraps around the 2^32 mark. Per RFC 1323, this should not cause the connect to fail. When a packet hits the ASA on an existing connection, the packet is dropped and the counter below increments:

ciscoasa/pri/act# sh asp drop

Frame drop:
 TCP packet failed PAWS test (tcp-paws-fail)

Conditions:
This occurs when the TS.value in a TCP packet/connection wraps around the 2^32 limit for that counter.
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.