Description

MS-RPC TCP session could not be fully established in asymmetric flow environment because TCP SYN-ACK packet was dropped by TCP proxy.
 

Symptoms

MS-RPC TCP 3-way handshake could not be established in an asymmetric flow environment as shown below. 
[Topology]
                           [client to server traffic]
      >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
+--------+       +--------+       +---------+       +----+---+       +--------+
|        |       |        +-------+   SRX   +-------+        |       |        |
|        |       |        |       +---------+       |        |       |        |
| CLIENT +-------+ SWITCH |                         | ROUTER +-------+ SERVER |
|(.9.38) |       |        |                         |        |       | (.1.1) |
|        |       |        +-------------------------+        |       |        |
+--------+       +--------+                         +--------+       +--------+
      <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
                           [server to client traffic]


[The scenario in problem]
1. To establish TCP session for the MS-RPC service, the MS-RPC client sent a TCP SYN packet to the server via the SRX.
2. The MS-RPC server sent a TCP SYN/ACK packet to the client without going through the SRX.
3. The MS-RPC client sent a TCP ACK packet to the server via the SRX, but the ACK packet was dropped by the SRX.
4. The MS-RPC server did not receive the TCP ACK packet from the client.
 

Solution

The TCP ACK packet drop is the expected behavior in the asymmetric flow environment.
When the MS-RPC ALG is enabled, the TCP-proxy function is enabled for the session by default on the SRX, and the TCP-proxy handles the TCP state machine.
In this case, TCP SYN and ACK packets are processed by the SRX without SYN-ACK.

When the TCP SYN packet is received, the SRX creates a session and the internal TCP-proxyy sets the TCP state to SYN.
It then needs a SYN-ACK packet to change the TCP state accordingly. 
However, the next packet processed by the TCP-proxy is ACK, due to receiving the unexpected packet, the ACK packet is dropped by the TCP-proxy.

Please disable MS-RPC ALG or configure the policy with the custom application including "alg ignore" as shown below. 
# set applications application TCP_135 term t1 alg ignore
# set applications application TCP_135 term t1 protocol tcp
# set applications application TCP_135 term t1 destination-port 135

Modification History

2023-08-32: initial publication