Websense url-server shows as down

When i do a sh url-server stat, it shows as the server/service as down. We have this setup the same way in over 20 locations, but i only run into this situation on a couple locations. I can reload the pix or asa and the service comes back up. I stays running for a few days, then stops again. What causes this? Is there a way to start it back up with reloading the pix/asa?
Neil2526Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

3nerdsCommented:
what does your "url-server" cofig line look like.

3nerds
0
Ehab SalemIT ManagerCommented:
When it shows that Websense server is down, is it really down? If so, you need to check physical availabnle RAM on the WS Policy server and the EIM Server.
0
Neil2526Author Commented:
url-server (inside) vendor websense host 10.0.0.24 timeout 15 protocol UDP version 4

filter https 443 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow
filter ftp 21 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow
filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow
http server enable


The websense server is not down, but for some reason on the asa or pix it says it is. If i reload it, all is ok and shows up.
I want to know what causes this, and is there a way on the asa/pix that i can restart this without reloading it?
thanks
0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

3nerdsCommented:
Couple of thoughts here.

First to get it back up without rebooting try:

no url-server (inside) vendor websense host 10.0.0.24 timeout 15 protocol UDP version 4

and then put it back:

url-server (inside) vendor websense host 10.0.0.24 timeout 15 protocol UDP version 4

Secondly

I would consider switching your current line to this:

url-server (inside) vendor websense host 10.0.0.24 timeout 30 protocol TCP version 4

As TCP is the preferred protocol straight from the websense documents and the legnthing of the time out may help as it appears the server is not responding or you are seeing a delay on your network causing it to drop.

Taken from here: Page 223

http://eproductivity.org/SupportPortal/documents/v631/WSInstall_Cisco.pdf

Good Luck,

3nerds
0
Neil2526Author Commented:
Tried your suggestion of taking out the websense command and putting it back in, with no luck on the restarting of the websense on the pix/asa. See out put below:
Server Statistics:
--------------------
10.0.0.24                         DOWN
  Vendor                          websense
  Port                            15868
  Requests total/allowed/denied   0/0/0
  Server timeouts/retries         0/0
  Responses received              0
  Response time average 60s/300s  0/0

I will try changing to tcp and lengthing the timeout and see what happens
0
3nerdsCommented:
From the asa can you ping the websense server?

3nerds
0
Neil2526Author Commented:
I can ping the websense server(located here at corporate) from the remote server located behing the asa, but not from the asa directly(icmp not turned on?)
0
3nerdsCommented:
but not from the asa directly(icmp not turned on?) ---> I assume you websense server is connected off your inside interface, as such ping should not be blocked unless the websense server has a firewall turned on. But if you can ping the websense server remotely then you should be able to from the asa. I would start my digging from here as the asa must be able to directly talk to the websense server or this problem will never go away.


Regards,

3nerds
0
Neil2526Author Commented:
sorry, i can ping(ping inside 10.0.0.24). I can change the statement from UDP to TCP but i afraid of the impact on the vpn traffic back and forth to the websense server and asa slowing down or connection.
0
3nerdsCommented:
Not sure I can answer that for you I can only tell you I have customers with vpn connected sites using tcp in the statement but only you can make that choice. I don't see exactly how changing that would affect it but stranger things have happened.

3nerds
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.