topic Re: we are running in Network Security

TCP flow terminated by inspection Engine.

mahesh18 — Tue, 12 Mar 2019 00:29:50 GMT

Hi eveyone,

I am seeing in log

%ASA-4-507003: tcp flow from xx:192.168.x.x/41211 to outside:69.171.224.36/80 terminated by inspection engine, reason - inspector reset unconditionally.

Need to undertsand what does this log mean?

Thanks

MAhesh

TCP flow terminated by inspection Engine.

Julio Carvajal — Thu, 29 Nov 2012 01:21:43 GMT

Hello,

What version are you running?

Are you using a websense?

Julio

TCP flow terminated by inspection Engine.

mahesh18 — Thu, 29 Nov 2012 15:29:10 GMT

Hi Julio,

Version is

Cisco Adaptive Security Appliance Software Version 8.0(5)27

Yes we are using websense

TCP flow terminated by inspection Engine.

Julio Carvajal — Thu, 29 Nov 2012 17:16:02 GMT

Hello Mahesh,

Right now we are facing the issue with the websense on the other discussion , can we doble check that the websense is reachable from the ASA and then focus on this..

Check this bug ID:CSCsx79354

Add url-block url-size, url-block url-mempool and add the filter command

with the cgi-truncate option

ex:

filter url 0 0 0 0 cgi-truncate

url-block url-mempool 5

url-block url-size 4

Even the though the page may load with the workaround above, the syslogs

(507003) may still continue to print.

So try the workaround as soon as you got the websense up ( if you keep getting those messages)

we are running

pedro.sanchez — Tue, 10 Nov 2015 17:26:55 GMT

we are running

Version 9.1(6) and we see the same error

any insight will be greatly appreciate it

Re: we are running

jhubel@midwave — Thu, 18 Feb 2021 23:01:22 GMT

Another case where the ASA will display the message "terminated by inspection engine" is when the FTP server's reply to the PASV command (which the client sends) contains a different IP address than the packets are coming from. When the ASA sees the packets coming from one IP address and the PASV reply contain a different address in the control response, this will fail inspection and the ASA will reset the connection.