ASA5585-SSP-20 9.1(2) Flow closed by inspection

[ALEXANDR LYKOV]

Hello,

We have site-2-site VPN between two the same ASAs and I'm connecting to the some switch beside of one  ASA through internet.

We had default configuration for inspection:

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect skinny 

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect icmp

  inspect ipsec-pass-thru

and after some times we have lost connection in the middle of ssh session or telnet or Radmin and others (like oracle sql)...

Debug show this messages:

Jun 29 2013 07:52:56: %ASA-6-302304: Teardown TCP state-bypass connection 356159 from outside:192.168.A.A/60669 to DB-PROD:10.B.B.B/1521 duration  0:00:23 bytes 2633284 Flow closed by inspection

Jun 29 2013 07:54:33: %ASA-6-302014: Teardown TCP connection 355841 for outside:10.X.X.X/59883 to management:10.Y.Y.Y/22 duration 0:02:48 bytes 176730 Flow closed by inspection

Jun 29 2013 07:54:38: %ASA-6-302014: Teardown TCP connection 356316 for outside:10.X.X.X/59902 to management:10.Y.Y.Y/23 duration 0:01:50 bytes 11250 Flow closed by inspection

This happened when i start ping A.A.A.A  repeat 100000

and after many !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! we have a stop ssh or telnet sesssion.

If we set

set connection advanced-options tcp-state-bypass

everything working fine.

What can we do with this inspection?

thx,

Alex.

[ALEXANDR LYKOV]

Hello,

I think it's not the same bug, because in my situation, tcp connection really closes incorrectly.

WBR,

Alex.

[Julio Carvajal]

Hello,

Yeah, I would like to see the traffic pattern of that connection,

I hope the issue does not happen again but just in case can you take a capture on both interfaces of the ASA to see what's the FW seeing that could be causing the problem?

Regards

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.

Remember to rate all of the helpful posts.

For this community that's as important as a thanks.