Telnet over Site to Site IPsec

Oct 27, 2007 8 Replies
V

I'm trying to troubleshoot a configuration that I inherited and I'm not sure where to start.



We have a retail client with three stores each with a PIX 501 connected via site to site IPsec tunnels to an ASA 5520 at a central location. Workstations at each store telnet to a Linux server at the central location.



For the past couple of weeks, the telnet connections at the store have been intermittently disconnecting. It seems to be happening maybe 3-4 times a day overall.



I don't see any errors on the firewalls logs or interfaces or on the network interface of the Linux server.



Any ideas on how I should troubleshoot this issue?



Thanks in advance! -- Vince


Vote
Twitter Facebook LinkedIn
N

Do you have some configs we can see?

Vote
Twitter Facebook LinkedIn
C

When the connection from linux disconnect does IPsec also disconnect from the peer.

Vote
Twitter Facebook LinkedIn
M

How many workstations at each store ?

The PIX 501 by default only has 10 user license so it will not support more than 10 sessions

Vote
Twitter Facebook LinkedIn
V

No, the IPsec doesn't disconnect. Other telnet sessions from the same location aren't dropped just one.

Vote
Twitter Facebook LinkedIn
V

Two of the stores have PIXes with 50 user licenses. Those stores have between 5 and 10 workstations.

One store only has 2 workstations so they have a 10 user license.

It doesn't seem to be a user license issue, as the dropped user can immediately reconnect.

Vote
Twitter Facebook LinkedIn
M

Assuming it is not an IPSEC issue, then I would put a sniffer ( PC with Etherreal) and capture the Telnet sessions to the Linux server.

When an incident occurs is it all of the workstations in a store that disconnect or just some?

Are all stores affected at the same time?.

Assuming it is not an IPSEC issue, then I would connect a sniffer ( PC with Etherreal) on the same LAN where the Linux server and capture the Telnet sessions to the Linux server. Look for TCP resets and the like.

Vote
Twitter Facebook LinkedIn
V

Generally it's just a couple of workstations at a time, not all workstations at a store nor all stores.

Vote
Twitter Facebook LinkedIn
M

The few workstations at a time - are they at one store or multiple stores - if they are at multiple stores then it may indicate that the issue is a the central site.

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required