Action: TCP reset from server for Forticlient EMS server

[alladas]

Hello,

We have a Forticlient EMS server hosted on a Hyper-V. The FortiClient telemetry on port 8013 is being shown as TCP reset from the server and pcaps indicate NO issues with the firewall. The Hyper-V is connected to virtual switch and the gateway is on the firewall. 

I am not 100% certain if this is an expected behavior of tcp-rst from EMS server after a FIN-ACK packet?

We are seeing this issue for few months now and no real support towards a resolution yet. Any inputs will help me narrow this down.

Thank you.

[fvddeen]

Hi, have you had any luck in solving this, I am seeing the same in my logs?

Thank you

[parambhai]

That is saying the Fortigate allowed it and the server blocked it with a reset, there might be a firewall on the server. Is it windows? Is there a green check next to the log you are viewing?

[fvddeen]

Traffic is not blocked:

Application Control

Application Name	S-TCP-8013
Category	unscanned
Risk	undefined
Protocol	6
Service	S-TCP-8013

Data

Received Bytes	6 kB
Received Packets	12
Sent Bytes	2 kB
Sent Packets	10

Action

Action	TCP reset from server
Policy ID	201
Policy UUID	4eb08b0e-2792-51ed-3a6c-d3d44aa063aa
Policy Type	Firewall

[Markus_M]

Go with a packet capture and see what exactly is sent and received. A reset is typically sent if the other end sends packets that do not belong to an existing session, since the expected session has already been removed.
For example, it could be a bad certificate from the EMS that triggers the session to be ended.

Best regards,

Markus