Interesting problem with pix 515 UR
- From: Andrea Borghi <andrea@xxxxxxx>
- Date: Mon, 14 Aug 2006 00:17:27 +0200
just an interesting problem with a pix515E-UR:
running 6.3(5)
This pix have only 2 ethernet interfaces; i have connected the ethernet0(outside) via a cross cable
to the 1760 installed by my connectivity provider; this have public IP addresses. To compensate for
the lack of other ethernet interfaces, i have configured the ethernet1 to do 802.1Q encap and
connected to the GE0/2 of a catalyst2950.
All the servers are directly connected to the catalyst 2950 and i see the error counters on the
phisical interfaces involved all at 0; all are at a correct speed/duplex setting as reported at both ends.
My problem is related to the basic connectivity. what i see is that the connectivity is present either
from the pix itself (i can ping to destinations from it) and through the pix (i can use the connections)
but every now and then, i cannot reach destinations *though* the pix and i *cannot ping from the pix*
itself the destinations.
The simple "clear arp" solves the problem, for another quantum of time, that is as longer as smaller is
the "arp timeout" programmed in the pix; with the default (14400 secs) i can see the problem in 10 minutes
or so, with a much smaller (150) seconds i see the problem only then there are no traffic for a time
(typically at night).
I have checked the arp cache and the mac-address-table on the switch and i can positively conclude that
the addresses are correct and in the correct vlan.
because i can always connect to the pix externally even during the problem, i sent the pix log to a server
and noted simply that there aren't abnormal messages. I see the connections built, and some time later the
SYN timeout because evidently the pix cannot send the traffic to the destination.
Any ideas? i'm frankly run out of ideas
(and quite tempted to leave this *as is* and go to the beach for some days... :)
following i am sending the pix config and the relevant part of the 2950 config
(with any sensitive information purged)
*PLEASE DO NOT TELL ME TO REVISE THE SECURITY POLICY* i know that, this is a fresh install and
i want to have a stable connectivity before hardening IP security and opening the ipsec VPNs i
need to. In fact, i have sensed this problem without access-lists or security at all, directly
from the pix console while installing the device.
bye
Andrea
-------------
Catalyst 2950 vlan config
Switch#sh vlan
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active Fa0/1, Fa0/2, Fa0/3, Fa0/4
Fa0/5, Fa0/6, Fa0/7, Fa0/8
Fa0/9, Fa0/10, Fa0/11,Fa0/12
Fa0/13, Fa0/14,Fa0/15,Fa0/16
Fa0/17, Fa0/18,Fa0/19,Fa0/20
2 server active Fa0/21, Fa0/22,Fa0/23,Fa0/24
3 external active
4 extra active
999 NativeForTrunks active
Switch#sh run
Building configuration...
Current configuration : 2034 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
logging buffered 32768 debugging
enable secret 5 XXXXXXXXXXXXXXXXXXXX
!
username root privilege 15 password 0 XXXXXXXXXXX
ip subnet-zero
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
[..]
!
interface FastEthernet0/21
description server webvecchio
switchport access vlan 2
load-interval 30
spanning-tree portfast
!
interface FastEthernet0/22
description server readytec
switchport access vlan 2
load-interval 30
spanning-tree portfast
!
interface FastEthernet0/23
description www server
switchport access vlan 2
load-interval 30
spanning-tree portfast
!
interface FastEthernet0/24
description Mail Server
switchport access vlan 2
load-interval 30
spanning-tree portfast
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
description Link to firewall PIX515 mode .1Q eth1
switchport trunk native vlan 999
switchport mode trunk
load-interval 30
duplex full
speed 100
!
interface Vlan1
no ip address
no ip route-cache
shutdown
!
interface Vlan2
ip address 10.10.10.2 255.255.255.0
no ip route-cache
!
ip default-gateway 10.10.10.1
no ip http server
!
logging trap debugging
logging facility local3
logging source-interface Vlan2
logging 10.10.10.60
!
[..]
!
end
-------------------------
Pix config:
pix# sh ver
Cisco PIX Firewall Version 6.3(5)
Cisco PIX Device Manager Version 3.0(4)
Hardware: PIX-515E, 128 MB RAM, CPU Pentium II 433 MHz
Encryption hardware device : VAC+ (Crypto5823 revision 0x1)
0: ethernet0: address is 0017.9514.6751, irq 10
1: ethernet1: address is 0017.9514.6752, irq 11
This PIX has an Unrestricted (UR) license.
pix# sh run
PIX Version 6.3(5)
interface ethernet0 100full
interface ethernet1 100full
interface ethernet1 vlan1 physical
interface ethernet1 vlan2 logical
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif vlan2 dmz security90
enable password XXXXXXXXXX encrypted
passwd XXXXXXXXXXX encrypted
hostname pix
domain-name XXXXXXX.it
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 10.10.10.60 mail
name 10.10.10.50 www
name 10.10.10.70 www-vecchio
name X.Y.Z.0 my-net
name X.X.X.40 public-net
name 10.10.10.80 rtec
name 10.10.10.2 switch1
name 192.168.3.0 Vpn
name 10.10.10.0 dmz-net
name 192.168.1.0 inside-net
name X.X.X.41 fastweb-gw
object-group service public-services tcp
description public services
port-object eq www
port-object eq smtp
port-object eq 90
port-object eq pop3
port-object eq imap4
object-group service my-access-tcp tcp
description Service access TCP Protocol
port-object eq 24
port-object eq telnet
port-object eq 81
port-object eq 3389
access-list outside_access_in permit tcp any interface outside object-group public-services
access-list outside_access_in permit tcp my-net 255.255.255.128 interface outside object-group my-access-tcp
access-list outside_access_in permit icmp any any
access-list outside_access_in permit ip Vpn 255.255.255.0 dmz-net 255.255.255.0
access-list inside_outbound_nat0_acl remark local traffic
access-list inside_outbound_nat0_acl permit ip inside-net 255.255.255.0 dmz-net 255.255.255.0
access-list dmz_outbound_nat0_acl permit ip dmz-net 255.255.255.0 Vpn 255.255.255.0
pager lines 24
logging on
logging monitor debugging
logging buffered debugging
logging trap debugging
logging facility 21
logging device-id string fw
logging host dmz mail
logging host outside X.Y.Z.66
icmp permit any outside
icmp permit any inside
icmp permit any dmz
mtu outside 1500
mtu inside 1500
ip address outside X.X.X.42 255.255.255.252
ip address inside 192.168.1.10 255.255.255.0
ip address dmz 10.10.10.1 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip verify reverse-path interface dmz
ip audit info action alarm
ip audit attack action alarm
ip local pool vpdn_pool 192.168.3.1-192.168.3.250
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address dmz
pdm location mail 255.255.255.255 dmz
pdm location www 255.255.255.255 dmz
pdm location www-vecchio 255.255.255.255 dmz
pdm location my-net 255.255.255.128 outside
pdm location rtec 255.255.255.255 dmz
pdm location switch1 255.255.255.255 dmz
pdm location Vpn 255.255.255.0 outside
pdm location dmz-net 255.255.255.0 dmz
pdm location inside-net 255.255.255.0 inside
pdm location fastweb-gw 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 150
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 inside-net 255.255.255.0 0 0
nat (dmz) 0 access-list dmz_outbound_nat0_acl
nat (dmz) 1 dmz-net 255.255.255.0 0 0
static (dmz,outside) tcp interface smtp mail smtp netmask 255.255.255.255 0 0
static (dmz,outside) tcp interface www www-vecchio www netmask 255.255.255.255 0 0
static (dmz,outside) tcp interface 24 mail ssh netmask 255.255.255.255 0 0
static (dmz,outside) tcp interface 90 mail www netmask 255.255.255.255 0 0
static (dmz,outside) tcp interface pop3 mail pop3 netmask 255.255.255.255 0 0
static (dmz,outside) tcp interface imap4 mail imap4 netmask 255.255.255.255 0 0
static (dmz,outside) tcp interface 3389 www-vecchio 3389 netmask 255.255.255.255 0 0
static (dmz,outside) tcp interface telnet switch1 telnet netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 fastweb-gw 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
ntp server 84.16.227.160 source outside
ntp server 194.100.206.70 source outside
ntp server 83.245.15.97 source outside
ntp server 85.214.43.186 source outside
ntp server 80.74.144.230 source outside
ntp server 192.36.143.150 source outside
ntp server 195.228.155.101 source outside
ntp server 80.203.145.142 source outside
http server enable
http my-net 255.255.255.128 outside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet inside-net 255.255.255.0 inside
telnet mail 255.255.255.255 dmz
telnet timeout 5
ssh my-net 255.255.255.128 outside
ssh timeout 60
console timeout 0
vpdn group pptp_vpn accept dialin pptp
vpdn group pptp_vpn ppp authentication chap
vpdn group pptp_vpn ppp authentication mschap
vpdn group pptp_vpn ppp encryption mppe 40 required
vpdn group pptp_vpn client configuration address local vpdn_pool
vpdn group pptp_vpn pptp echo 300
vpdn group pptp_vpn client authentication local
vpdn username XXXXXXXX password *********
vpdn enable outside
dhcpd address 192.168.1.200-192.168.1.254 inside
dhcpd dns mail
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd domain XXXXXXXX.it
dhcpd auto_config outside
dhcpd enable inside
username root password XXXXXXXXXXXXXX encrypted privilege 15
terminal width 80
.
- Follow-Ups:
- Prev by Date: Cisco NAC & IP spoofing
- Next by Date: Re: Interesting problem with pix 515 UR
- Previous by thread: Cisco NAC & IP spoofing
- Next by thread: Re: Interesting problem with pix 515 UR
- Index(es):
Relevant Pages
|
