Dropped packet between PIX

yann.boulet · ‎10-18-2007

hello,

i have some dropped packets between 2 PIX first one is PIX 525 V7 and second one is PIX 520 V6.3, there is a cisco catalyst to connect them and i can see dropped packets only on the PIX 525, how can i troubleshoot it ?

The problem is when i access to an https application behind the PIX 520 and to PDM on it, i can't display some pages and on PDM i have some time PDM was unable to contact the PIX, but for the SSH connection i have no issue.

Thank you

rsrivast · ‎10-19-2007

hello

thanks for the question. I have posted the question to internal PIX team and will let you know when I hear an answer. I suggest to check http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/

for more details, since this is mainly IOS security discussion.

thanks

yann.boulet · ‎10-19-2007

thank you, i will try to check the link you suggest me

yann.boulet · ‎10-24-2007

hi,

there is no news since my post ?

thx

m · ‎10-30-2007

try to use the norandomseq keyword on your 6.3 PIX with the

"static (inside,outside) netmask norandomseq"

command to try to solve this problem and to stop the PIX from offsetting the TCP sequence number. this might help if "both" devices scramble tcp sequence numbers.

p-allen · ‎11-03-2007

sounds like a simalar issue we are having. We use a ASA firewall that connects to our isp which also uses a firewall and are seeing alot of out of order packets. We are mainly seeing the issue with one website that sometimes everything is fine and other times we get alot of page can not be displayed. The site is saying that no one else is having an issue but us. The ISP is saying that they also see alot of out of order packets for our connections to the internet. I am wondering if this could be our issue also.

excession · ‎11-03-2007

Hi Yann,

Could you describe your topology a little more? From what I understand you have the following.

PDM-----PIX525---CAT---PIX520

Does this issue only happen appear for https?

Is this a new setup or were there changes made recently?

How can you see the dropped packets?

In order to troubleshoot this issue I suggest you get captues on the PIX525 and see what exactly is being dropped. See the following link for details on the capture command

http://www.cisco.com/en/US/docs/security/asa/asa70/command/reference/c.html#wp1950270

Note you can capture based on "type asp-drop".

You could try to run a "show asp drop" before you experience the problem, the run it again after trying to display the pages you are having problems with and see what counter is increasing.

Have you Syslog? What level are logs enabled at? Maybe you could also check these logs to identify what is being dropped.Check the logs before and after a session.

sachin.verma · ‎11-05-2007

Hi yann,

It looks like mtu size issue to me.Kindly check the mtu size defined on the outside and inside interfaces on pix 525 and pix 520 connecting each other on switch.

regards

Sachin Verma