Skip to main content
alladas
alladas
New Member
March 26, 2020
Question

Action: TCP reset from server for Forticlient EMS server

  • March 26, 2020
  • 3 replies
  • 19385 views

Hello,

 

We have a Forticlient EMS server hosted on a Hyper-V. The FortiClient telemetry on port 8013 is being shown as TCP reset from the server and pcaps indicate NO issues with the firewall. The Hyper-V is connected to virtual switch and the gateway is on the firewall. 

 

I am not 100% certain if this is an expected behavior of tcp-rst from EMS server after a FIN-ACK packet?

 

We are seeing this issue for few months now and no real support towards a resolution yet. Any inputs will help me narrow this down.

 

Thank you.

    3 replies

    fvddeen
    fvddeen
    New Member
    December 15, 2023

    Hi, have you had any luck in solving this, I am seeing the same in my logs?

    Thank you

     

      parambhai
      parambhai
      New Member
      December 15, 2023

      That is saying the Fortigate allowed it and the server blocked it with a reset, there might be a firewall on the server. Is it windows? Is there a green check next to the log you are viewing?

      fvddeen
      fvddeen
      New Member
      December 15, 2023

      Traffic is not blocked:

      Application Control

       

      Application NameS-TCP-8013
      Categoryunscanned
      Riskundefined
      Protocol6
      ServiceS-TCP-8013

       

      Data

       

      Received Bytes6 kB
      Received Packets12
      Sent Bytes2 kB
      Sent Packets10

       

      Action

      ActionTCP reset from server
      Policy ID201
      Policy UUID4eb08b0e-2792-51ed-3a6c-d3d44aa063aa
      Policy TypeFirewall

       

        Markus_M
        Staff & Editor
        Markus_M
        Staff & Editor
        December 15, 2023

        Go with a packet capture and see what exactly is sent and received. A reset is typically sent if the other end sends packets that do not belong to an existing session, since the expected session has already been removed.
        For example, it could be a bad certificate from the EMS that triggers the session to be ended.

         

        Best regards,

         

        Markus

        Terms & ConditionsAccessibility statement