IP inspect feature general question

[tscaon001]

Hello all,

I have seen that the ip inspect feature sends sometimes some RST packets. I would like to know if it was possible to keep the ip inspect feature enabled and doing its job but without sending the RST packets. I do not have the customer's configuration but it is just a theoretical question.

Do not hesitate to come back to me if you need further information. Thanks in advance for the help !

Best regards,

Thomas

[Maykol Rojas]

Hello; 

This can only be done for the following scenarios:

If traffic is being denied by an ACL. 

If AAA denies the traffic

If the packets that come, do not belong to an existing connection. 

I have not seen an specific case where the inspection sends a RST packet (it does not mean it doesnt happen), which inspection feature is sending you the reset? 

Mike. 

[Paul Chapman]

Hi -

Some inspections permit you to modify their behavior and some don't.

For example the default ESMTP inspection will cause the connection to drop if the mail servers do not establish a TLS session.  This behavior can be modified or turned off.

Conversely, ICMP inspection cannot be modified. Just enabled or disabled.

PSC