inspect http issue - unable to browse secure site.

amitmarathe — Fri, 21 Feb 2020 12:13:51 GMT

Hi,

Current version of the asa firewall is 7.1(2) in which when the inspect http is enabled, while opening secure site like axis bank account or any money market site either blank page display or page can not display error message appear. When i disable this command i am able to access all the secure sites properly. It looks like a bug but in the release not i am not finding any bug related to this issue. Please help me resolve this issue.

Amit M.

Re: inspect http issue - unable to browse secure site.

m.kafka — Fri, 28 Jan 2011 06:05:30 GMT

maybe you should repost this in the section "Firewall"

inspect http does by default nothing to https tcp/443 connections. there must be some other configurations which are different from factory default

Re: inspect http issue - unable to browse secure site.

amitmarathe — Fri, 28 Jan 2011 12:33:33 GMT

Thanks for the reply. When i disable http inspection and when i try to open login page for some of the site then this page cannot be display appear. Also i try MSS might get exceeded and found in the show asp drop tcp mss is not showing. But still i create a class for mass exceed and apply it in globle configuration but it does not work. Latter i have to disable the http inspection and it started working. Now the question is while clicking on login butten it will go from http to https page during this shifting of http to https why does it affect the connection when enable http inspection.

Following is the show asp drop output.

Please check

PIXFIREWALL# sho asp drop

Frame drop:

Invalid IP header 10

No route to host 13

Reverse-path verify failed 398846

Flow is denied by configured rule 107075

Flow denied due to resource limitation 35

Invalid SPI 2

First TCP packet not SYN 62706

TCP failed 3 way handshake 1211

TCP RST/FIN out of order 39

TCP packet SEQ past window 1

TCP invalid ACK 1

TCP packet buffer full 209

TCP RST/SYN in window 14

TCP DUP and has been ACKed 10411

TCP packet failed PAWS test 10

IPSEC tunnel is down 137

IP option drop 551

Expired flow 26

ICMP Inspect seq num not matched 1057

ICMP Error Inspect different embedded conn 60

DNS Inspect id not matched 4674

IPS Module requested drop 8

FP L2 rule drop 22988

Interface is down 8

Flow drop:

Flow terminated by IPS 16

NAT failed 13066

Tunnel being brought up or torn down 514

Need to start IKE negotiation 2136

Inspection failure 60

topic inspect http issue - unable to browse secure site. in Network Security

inspect http issue - unable to browse secure site.

Re: inspect http issue - unable to browse secure site.

Re: inspect http issue - unable to browse secure site.