A device has been connected to the LAN port of SSR and an application policy is configured to allow the traffic from the LAN port to a server residing in the internet. However, the traffic is not reaching the server as expected.

We can see a RST packet sent by the server after the initial SYN packets are sent by the device connected to the LAN port of SSR

Tcpdump captured on the LAN and the WAN port of SSR shows a reset packet sent by the Server residing in the internet.

22 17.659645952 5.5.5.5 10.10.10.10 TCP 58 443 → 54255 [RST] Seq=2 Win=0 Len=0

In the above example, 5.5.5.5 is the server IP-address and 10.10.10.10 is the IP-Address of the device connected to the LAN port of SSR.

Upon checking the highway.log, we could see the below errors for the 5.5.5.5 IP-Address

Jul 20 11:20:52.819 [HWMC|IPPC] INFO (ApplicationDiTP) Failed to find app name for (ip: 5.5.5.5, port: 443, protocol: 6): Got bad response code 'server returned unknown HTTP status code 0'

When we checked whether SSR is able to identify the application based on the IP-Address, we found that SSR is unable to identify the application however it is able to do so for other IP-Addresses.

Command : lookup application by-address node node0 router ssr_router 5.5.5.5 443 tcp

*root@ssr_conductor.ssr_conductor# lookup application by-address node node0 router ssr_router 5.5.5.5 443 tcp

✖ Looking up application identification...

% Error: Look up failed: You are unauthorized to access this resource.

The reason for this failure is that the application-director service was not running. You can restart the service by using the command "systemctl restart application-director".

Once the service was restarted, SSR was able to identify the application for this IP-Address and the traffic was able to reach the specified server.

The permanent fix for this issue is available in the SSR 6.2.9 version. Please upgrade the SSR to the 6.2.9 GA release.