cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
7393
Views
10
Helpful
5
Replies

TCP flow terminated by inspection Engine.

mahesh18
Frequent Contributor
Frequent Contributor

Hi eveyone,

I am seeing in log

%ASA-4-507003: tcp flow from xx:192.168.x.x/41211 to outside:69.171.224.36/80 terminated by inspection engine, reason - inspector reset unconditionally.

Need to undertsand what does this log mean?

Thanks

MAhesh

2 Accepted Solutions

Accepted Solutions

Julio Carvajal
Advisor
Advisor

Hello,

What version are you running?

Are you using a websense?

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

Hello Mahesh,

Right now we are facing the issue with the websense on the other discussion , can we doble check that the websense is reachable from the ASA and then focus on this..

Check this bug ID:CSCsx79354

Add url-block url-size, url-block url-mempool and add the filter command

with the cgi-truncate option


ex:

filter url 0 0 0 0 cgi-truncate

url-block url-mempool 5

url-block url-size 4


Even the though the page may load with the workaround above, the syslogs

(507003) may still continue to print.

So try the workaround as soon as you got the websense up ( if you keep getting those messages)

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

View solution in original post

5 Replies 5

Julio Carvajal
Advisor
Advisor

Hello,

What version are you running?

Are you using a websense?

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

Hi Julio,

Version is

Cisco Adaptive Security Appliance Software Version 8.0(5)27

Yes we are using websense

Hello Mahesh,

Right now we are facing the issue with the websense on the other discussion , can we doble check that the websense is reachable from the ASA and then focus on this..

Check this bug ID:CSCsx79354

Add url-block url-size, url-block url-mempool and add the filter command

with the cgi-truncate option


ex:

filter url 0 0 0 0 cgi-truncate

url-block url-mempool 5

url-block url-size 4


Even the though the page may load with the workaround above, the syslogs

(507003) may still continue to print.

So try the workaround as soon as you got the websense up ( if you keep getting those messages)

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

we are running 

 Version 9.1(6) and we see the same error 

any insight will be greatly appreciate it 

Another case where the ASA will display the message "terminated by inspection engine" is when the FTP server's reply to the PASV command (which the client sends) contains a different IP address than the packets are coming from.  When the ASA sees the packets coming from one IP address and the PASV reply contain a different address in the control response, this will fail inspection and the ASA will reset the connection.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers