1. Home
  2. Cisco Systems
  3. Cisco Pix debug help

Cisco Pix debug help

Hi

I have a problem with a cisco pix 515E os version 6.2(2) and I hope someone can help wme with this.

Basically I have one database server behind this firewall and clients connect to it through this firewall. At the moment the firewall has an access-group command that allows all clients to connect through. The problem I am experiencing happens to only two clients running redhat linux. What happens is randomly I get TCP Timeouts from these servers, say roughly one in every one thousand tcp requests. By sniffing the network on the pix external facing network interface I receive packets similar to this:

19:49:15.758315 opal.example.com.44808 > neptune.example.com.1521: S 3506603012:3506603012(0) win 5840 (DF)

But sniffing the internal facing interface (i.e the database end), those packets don't come through. Its as though the pix has silently dropped them.

Now so far from my tests, I've noticed that a failure has always been occurring when the mss value is set to 1460. Although this might be a red-herring as trwaling through the capture logs I can see other SYN packets pass through with that value. Setting the "sysopt tcpmss" value to 1460 doesn't make any difference.

My questions are:

1) What other techniques are there to debug this? 2) Am I on the right track by looking at the mss value? 3) What else could be the problem? 4) Is this a known bug in the cisco OS?

I really appreciate any help given.

Thanks in advance Dan

Reply to
dan.track
Loading thread data ...

might be CSCsc14915 TCP connections through the firewall may be silently blocked. fixed in interim maintenance release 6.3(5.106)

Reply to
Merv

might be CSCsc14915 TCP connections through the firewall may be silently blocked. fixed in interim maintenance release 6.3(5.106)

Reply to
Merv

might be CSCsc14915 TCP connections through the firewall may be silently blocked. fixed in interim maintenance release 6.3(5.106)

Reply to
Merv

might be CSCsc14915 TCP connections through the firewall may be silently blocked. fixed in interim maintenance release 6.3(5.106)

Reply to
Merv

Hi

Thanks for heads up with this. This bug relates to spoofed packets, by default servers don't create spoofed packets, as far as I know. Any other ideas as to why this may be happening.

Thanks Dan

Reply to
Dan_track

Have you tried running the debug sqlnet command?

Reply to
ekn

You PIX software is fairly dated so you might want to upgrade to 6.3(5) to see if the problem is still present. If it is then you would need to open a Cisco TAC case assuming you have SmartNet coverage for the box

Reply to
Merv

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.