TCP packet out of state: First packet isn't SYN & Outlook is trying to retrieve data from the Microsoft Exchange Server [CAS-ARray]

Question

We are transitioning from Exchange 2003 to Exchange 2010.  We found Outlook online mode (non-cached mode) have many warning "Outlook is trying to retrieve data from the Microsoft Exchange Server [CAS-ARray]", usually happen when users tried to open
address book but sometimes even normal operation like click the Send button.  The problem does not affect OWA and extremely rare when Outlook is running in cached mode.  Check the firewall logs, we notice a lot of "TCP Packet Out of State" drops.
We have a lot from the CAS/HT to DC/GC on TCP_3268 and LDAP.  And the errors are "TCP packet out of state: First packet isn't SYN" with tcp_flags FIN-ACK, PUSH-ACK.
We also have a lot from CAS/HT to the Outlook Clients on the static RPC port (TCP_59933).   And the errors are "TCP packet out of state: First packet isn't SYN" with tcp_flags FIN-ACK, PUSH-ACK and RST-ACK, ACK.
This happens even on Outlook 2010 which I though it has TCP Keep Alive implmented to keep the session active within 1 hour. 
Can somebody tell me if these out-of-state are the cause of our problem?  And how to fix it?
THANK 1,000,000

Answer 1

Hello AndyHWC,
I did some consulting with our CAS team and received the following feedback to your post:
It is difficult to determine what is causing resets without seeing the captures first hand however, the concern is that you are seeing dropped packets on the firewall logs.  Where is this firewall located?
Based on the description "Check the firewall logs, we notice a lot of "TCP Packet Out of State" drops." and "We have a lot from the CAS/HT to DC/GC on TCP_3268 and
LDAP." indicates to me that the firewall is between CAS and GC.  This not supported under any circumstances and would explain the issue they are seeing with clients trying to "retrieve data from the GC".
If there is not a firewall between the GC and CAS then a Microsoft support engineer would need to have concurrent Netmon Captures from client, CAS, GC during the
issue to analyze.  If only one GC exists consider adding another GC to handle the client requests and for fault tolerance.
Also verify that all NIC card drivers are updated to the latest driver version
More information about firewalls with Exchange 2007/2010
http://msexchangeteam.com/archive/2009/10/21/452929.aspx
http://technet.microsoft.com/en-us/library/bb232184(EXCHG.80).aspx
You can install the Client Access server role on an Exchange 2007 computer that is running any other server roles except for the Edge Transport server role. You
cannot install the Client Access server role on a computer that is installed in a cluster. Installation of a Client Access server in a perimeter network is not supported.
http://technet.microsoft.com/en-us/library/dd577077(EXCHG.80).aspx
“The Installation of a Client Access Server in a Perimeter Network Is Not Supported
Issue You may want to install an Exchange 2007 Client Access server in a perimeter network. However, this type of installation is not supported in Exchange
2007.
Cause The Exchange 2007 Client Access server role is not supported in any configuration in which a firewall is located between the Client Access server
and a Mailbox server or a domain controller. This includes firewall devices, firewall programs, or any program or device that is designed to restrict traffic between two network locations.
For correct operation, Client Access servers require typical domain connectivity to domain controllers and global catalog servers. Because any devices
or programs that restrict or reduce access to domain controllers or global catalog servers may affect the correct operation of the Client Access server, we do not support this type of configuration.
Resolution To resolve this issue, move the Client Access servers to the internal network. For more information about the ports that Exchange 2007 uses
for various services, see Data Path Security Reference.”
Thanks,
Kevin Ca - MSFT
Kevin Ca - MSFT