Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
alladas
New Contributor

Action: TCP reset from server for Forticlient EMS server

Hello,

 

We have a Forticlient EMS server hosted on a Hyper-V. The FortiClient telemetry on port 8013 is being shown as TCP reset from the server and pcaps indicate NO issues with the firewall. The Hyper-V is connected to virtual switch and the gateway is on the firewall. 

 

I am not 100% certain if this is an expected behavior of tcp-rst from EMS server after a FIN-ACK packet?

 

We are seeing this issue for few months now and no real support towards a resolution yet. Any inputs will help me narrow this down.

 

Thank you.

4 REPLIES 4
fvddeen
New Contributor

Hi, have you had any luck in solving this, I am seeing the same in my logs?

Thank you

 

parambhai
New Contributor

That is saying the Fortigate allowed it and the server blocked it with a reset, there might be a firewall on the server. Is it windows? Is there a green check next to the log you are viewing?

https://19216801.onl/ https://routerlogin.uno/
fvddeen

Traffic is not blocked:

Application Control

 

Application NameS-TCP-8013
Categoryunscanned
Riskundefined
Protocol6
ServiceS-TCP-8013

 

Data

 

Received Bytes6 kB
Received Packets12
Sent Bytes2 kB
Sent Packets10

 

Action

ActionTCP reset from server
Policy ID201
Policy UUID4eb08b0e-2792-51ed-3a6c-d3d44aa063aa
Policy TypeFirewall

 

Markus_M
Staff
Staff

Go with a packet capture and see what exactly is sent and received. A reset is typically sent if the other end sends packets that do not belong to an existing session, since the expected session has already been removed.
For example, it could be a bad certificate from the EMS that triggers the session to be ended.

 

Best regards,

 

Markus

Labels
Top Kudoed Authors