cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

6011
Views
10
Helpful
5
Replies
mahesh18
Frequent Contributor

TCP flow terminated by inspection Engine.

Hi eveyone,

I am seeing in log

%ASA-4-507003: tcp flow from xx:192.168.x.x/41211 to outside:69.171.224.36/80 terminated by inspection engine, reason - inspector reset unconditionally.

Need to undertsand what does this log mean?

Thanks

MAhesh

2 ACCEPTED SOLUTIONS

Accepted Solutions
Julio Carvajal
Advisor

Hello,

What version are you running?

Are you using a websense?

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

Hello Mahesh,

Right now we are facing the issue with the websense on the other discussion , can we doble check that the websense is reachable from the ASA and then focus on this..

Check this bug ID:CSCsx79354

Add url-block url-size, url-block url-mempool and add the filter command

with the cgi-truncate option


ex:

filter url 0 0 0 0 cgi-truncate

url-block url-mempool 5

url-block url-size 4


Even the though the page may load with the workaround above, the syslogs

(507003) may still continue to print.

So try the workaround as soon as you got the websense up ( if you keep getting those messages)

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

5 REPLIES 5
Julio Carvajal
Advisor

Hello,

What version are you running?

Are you using a websense?

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

Hi Julio,

Version is

Cisco Adaptive Security Appliance Software Version 8.0(5)27

Yes we are using websense

Hello Mahesh,

Right now we are facing the issue with the websense on the other discussion , can we doble check that the websense is reachable from the ASA and then focus on this..

Check this bug ID:CSCsx79354

Add url-block url-size, url-block url-mempool and add the filter command

with the cgi-truncate option


ex:

filter url 0 0 0 0 cgi-truncate

url-block url-mempool 5

url-block url-size 4


Even the though the page may load with the workaround above, the syslogs

(507003) may still continue to print.

So try the workaround as soon as you got the websense up ( if you keep getting those messages)

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

we are running 

 Version 9.1(6) and we see the same error 

any insight will be greatly appreciate it 

Another case where the ASA will display the message "terminated by inspection engine" is when the FTP server's reply to the PASV command (which the client sends) contains a different IP address than the packets are coming from.  When the ASA sees the packets coming from one IP address and the PASV reply contain a different address in the control response, this will fail inspection and the ASA will reset the connection.

Content for Community-Ad

This widget could not be displayed.