topic Re: Deny tcp src inside: WHY????????????? in Network Security https://community.cisco.com/t5/network-security/deny-tcp-src-inside-why/m-p/1331152#M824608 <HTML><HEAD></HEAD><BODY><P>FTP fixup is enabled, but ftp session is no longer than 2 minutes so how can it timed out? </P></BODY></HTML> Fri, 30 Oct 2009 08:20:24 GMT albertobrivio42 2009-10-30T08:20:24Z Deny tcp src inside: WHY????????????? https://community.cisco.com/t5/network-security/deny-tcp-src-inside-why/m-p/1331150#M824545 <P>Dear ALL,</P><P>I have a PIX 515E 6.3 , a ftp server on windows 2000. A customer of me, sometimes esperinces ftp sessions hung without any particular reason. In the PIX's log I can find this error: Deny tcp src inside:192.168.0.239/20 dst outside: a.b.c.d/2435 by access-group "acl-outbound"</P><P>Why this behaviour since acl-outbound acl permit ftp sessions?</P><P></P><P> Regards</P><P></P><P> Alberto Brivio</P> Mon, 11 Mar 2019 16:34:05 GMT https://community.cisco.com/t5/network-security/deny-tcp-src-inside-why/m-p/1331150#M824545 albertobrivio42 2019-03-11T16:34:05Z Re: Deny tcp src inside: WHY????????????? https://community.cisco.com/t5/network-security/deny-tcp-src-inside-why/m-p/1331151#M824566 <HTML><HEAD></HEAD><BODY><P>You can check for ftp fixup. If it is enabled that could explain the behavior. If the fixed timed out then the pinholoe for ftp is no longer open.</P><P></P><P>I hope it helps.</P><P></P><P>PK</P><P></P></BODY></HTML> Thu, 29 Oct 2009 17:09:58 GMT https://community.cisco.com/t5/network-security/deny-tcp-src-inside-why/m-p/1331151#M824566 Panos Kampanakis 2009-10-29T17:09:58Z Re: Deny tcp src inside: WHY????????????? https://community.cisco.com/t5/network-security/deny-tcp-src-inside-why/m-p/1331152#M824608 <HTML><HEAD></HEAD><BODY><P>FTP fixup is enabled, but ftp session is no longer than 2 minutes so how can it timed out? </P></BODY></HTML> Fri, 30 Oct 2009 08:20:24 GMT https://community.cisco.com/t5/network-security/deny-tcp-src-inside-why/m-p/1331152#M824608 albertobrivio42 2009-10-30T08:20:24Z Re: Deny tcp src inside: WHY????????????? https://community.cisco.com/t5/network-security/deny-tcp-src-inside-why/m-p/1331153#M824626 <HTML><HEAD></HEAD><BODY><P>Not likely.</P><P></P><P>Unless the inspection tears the data channel connection for some other reason.</P><P></P><P>PK</P></BODY></HTML> Fri, 30 Oct 2009 20:51:38 GMT https://community.cisco.com/t5/network-security/deny-tcp-src-inside-why/m-p/1331153#M824626 Panos Kampanakis 2009-10-30T20:51:38Z