Core issue
This occurs when you originate a TCP connection from an interface on another router, and the ip inspect interface configuration command has not been issued.
The output of the debug ip packet detail privileged EXEC command indicates that the SYN/ACK reply is dropped by inspect, as shown:
IP: s=192.168.128.16 (FastEthernet0.2), d=192.168.192.69 (FastEthernet0.3), len 48, dropped by inspect
TCP src=23, dst=3403, seq=143608234, ack=3669485014, win=5840 ACK SYN
Resolution
Remove the ip inspect interface configuration command from the interface of the router that is supposed to send the SYN/ACK reply. For more information, refer to Cisco bug ID CSCec78231. The Bug Toolkit provides information on which Cisco IOS Software version includes the fix for this defect.
