错误日志：

FWSM-1(config)# show log as | in 15.225

6|Aug 31 2012 09:44:36|106015: Deny TCP (no connection) from 10.10.15.225/80 to 14.20.31.233/31073 flags SYN ACK  on interface In-Internal_2

6|Aug 31 2012 09:44:37|106015: Deny TCP (no connection) from 10.10.15.225/80 to 14.20.31.233/31041 flags SYN ACK  on interface In-Internal_2

6|Aug 31 2012 09:44:37|106015: Deny TCP (no connection) from 10.10.15.225/80 to 14.20.31.233/31169 flags SYN ACK  on interface In-Internal_2

6|Aug 31 2012 09:44:37|106015: Deny TCP (no connection) from 10.10.15.225/80 to 14.20.31.233/31105 flags SYN ACK  on interface In-Internal_2

6|Aug 31 2012 09:44:37|106015: Deny TCP (no connection) from 10.10.15.225/80 to 14.20.31.233/31137 flags SYN ACK  on interface In-Internal_2

基本理解：

这个问题是说错误“没有连接” 　 　　

出于某些原因,连接到web服务器被关闭。尝试做一个捕获,确定数据流发生问题所在。

FWSM-1(config)# access-list cap_acl permit tcp host 10.10.15.225 any

FWSM-1(config)# access-list cap-acl permit tcp any host 10.10.15.225

FWSM-1(config)# capture cap_traff access-list cap_acl in In-Internal_2

FWSM-1(config)# show capture cap_traff

12 packets seen, 12 packets captured

   1: 10:00:01.1190680460 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57601: S 74049662:74049662(0) ack 2279964660 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

   2: 10:00:01.1190680700 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57633: S 2044127287:2044127287(0) ack 75930879 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

   3: 10:00:04.1190683450 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57601: S 74049662:74049662(0) ack 2279964660 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

   4: 10:00:04.1190683700 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57633: S 2044127287:2044127287(0) ack 75930879 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

   5: 10:00:05.1190684460 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57601: S 74049662:74049662(0) ack 2279964660 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

   6: 10:00:05.1190685060 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57633: S 2044127287:2044127287(0) ack 75930879 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

   7: 10:00:10.1190689460 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57601: S 74049662:74049662(0) ack 2279964660 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

   8: 10:00:10.1190689710 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57633: S 2044127287:2044127287(0) ack 75930879 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

   9: 10:00:11.1190690660 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57601: S 74049662:74049662(0) ack 2279964660 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

  10: 10:00:11.1190691070 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57633: S 2044127287:2044127287(0) ack 75930879 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

  11: 10:00:23.1190702670 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57601: S 74049662:74049662(0) ack 2279964660 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

  12: 10:00:23.1190703070 802.1Q vlan#115 P0 10.10.15.225.80 > 14.20.31.233.57633: S 2044127287:2044127287(0) ack 75930879 win 5840 <mss 1460,nop,nop,sackOK,nop,[|tcp]>

12 packets shown

分析与结论：

从抓取的日志明显看出3次握手没有建立成功所以，即：

SYN: Outside --> Inside

SYN-ACK: Inside --> Outside

检查Inside --> Outside的路由和80端口是否放通。我的问题所在是上层策略路由给拒绝了。

MFSC-1(config)#ip access-list extended to_2901_port  

MFSC-1(config-ext-nacl)#permit tcp host 10.10.15.225 any eq 80 //故障时做的策略

MFSC-1(config-ext-nacl)#permit tcp host 10.10.15.225 eq 80 any //错误所在，没有放通。

原以为在防火墙上出现有deny的日志变是自身策略或者路由所致，不断排查写的策略和测试。遇到该问题后我得承认以前的观点是错误的。杯具...