How many sessions do you have going thru this box? What does a "sho ip inspect stat" command show. If you're plugged into the console when you enable it, do you see a "getting aggressive" message appear, this indicates that the router is seeing too many sessions and is going to start blocking new ones.
On a busy router the default number of connections and half-open connections may not be enough. Try tweaking the following:
> ip inspect max-incomplete high xxxxx
> ip inspect max-incomplete low xxxx
> ip inspect one-minute high xxxx
> ip inspect one-minute low xxxx
and see if you get better results. Use the output of the "sho ip inspect stat" command to figure out how many sessions the router currently has, it can sometimes take a while to get a good value.
