Hi,
Below are the capture of the tcpdump it seems that the internal vlan ip 10.10.10.1 is the one sending the (R)reset flag
23:34:59.063021 IP 10.10.10.1.35840 > 10.10.10.2.http: S 1589453853:1589453853(0) win 5840
23:34:59.065541 IP 10.10.10.2.http > 10.10.10.1.35840: S 3686360985:3686360985(0) ack 1589453854 win 5792
.
some output omitted
.
23:34:59.098055 IP 10.10.10.1.35840 > 10.10.10.2.http: F 8:8(0) ack 2897 win 91
23:34:59.099024 IP 10.10.10.2.http > 10.10.10.1.35840: P 2897:4097(1200) ack 8 win 5792
23:34:59.099613 IP 10.10.10.1.35840 > 10.10.10.2.http: R 1589453861:1589453861(0) win 0