Question

After deploying a new stateful firewall appliance in front of a two-subnet application tier, users report that some TCP connections to the web servers hang and eventually time out, while others succeed. Packet captures on the web servers show inbound SYN packets arriving and the servers sending SYN-ACK responses, but the clients never receive them. The firewall logs show the SYN packets passing through, but no matching entry for the return SYN-ACK traffic. What is the MOST likely root cause?

Accepted Answer

Return traffic is taking a different path than the inbound traffic, so the stateful firewall drops the SYN-ACK because it has no matching session state (asymmetric routing)

Answer

The web servers are configured with an MTU value larger than the firewall supports, causing fragmentation of the SYN-ACK packets

Answer

The TLS certificate on the web servers has expired, preventing the handshake from completing

Answer

The firewall's connection table is exhausted, dropping all new inbound SYN packets