View Single Post
  #2 (permalink)  
Old 2007-10-19
gavvys gavvys is offline
Senior Member
 
Join Date: 2007-04-10
Location: India
Posts: 141
Rep Power: 2
gavvys has an average reputation (10+)
Send a message via Yahoo to gavvys
Default Re: https web page hangs with NGX and NAT

Hi
Well the same problem of resetting the connection was faced by one of my friends.This issue is not with the NATting.
In that case there was also HTTPS communication and he was facing the issue with stateful inspection.

"Drop out of state TCP Packets" refers to instances where the Firewall doesn't recognize a proper three way hand shake of the TCP connection. When this function is on, the firewall expects to see the full TCP connection establishment process of SYN, SYN ACK, etc. While examining the TCP connection establishment, the firewall will check the first SYN packet for authorization against the Firewall-1 Rule Base.
If the firewall receives a SYN-ACK packet, it goes to the state table to look for the connection (the SYN should already be there), if the firewall fails the find the connection reference, the packet will be dropped with the "Drop out of state TCP Packets" message.
When this option is unchecked in Global properties menu (under "Stateful Inspection -> Out of state packets"), it simply allows TCP packets, that the firewall cannot find in the state table to be tested against the Rule Base as a secondary option.

Kindly check the issue.
Let me know if this resolves your issue or not.

Regards
Ranjit
Reply With Quote