ASA behind PIX problems

Unanswered Question
Sep 16th, 2009
User Badges:

We have an ASA 5550 cluster behind a PIX 525 firewall. I'm trying to connect to the internet that is behind the PIX 525 from an inside host behind the ASA. I configured overload on the ASA outside interface (Dynamic NAT rule). The ASA outside interface is connected to the PIX 525 DMZ segment. Also, there is a Dynamic NAT rule on the PIX for overloading all DMZ addresses to the Outside PIX interface (Internet).

From my inside host i can ping addresses on the internet (, but a websession is not possible. On both firewalls the NAT rules are ok,firewall policies permit ip any.

I also did a test to make a static nat rule for port 3389 on the PIX and on the ASA. I tried to set up a RDP connection form the Internet to my inside host. Netstat -an on inside host display an "Established" connection on port 3389 from the Outside internet host.. On my outside Internet host, it takes 30 seconds, noting there...

I don't know where to find the solution to this problem..

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
remco.gussen Thu, 09/17/2009 - 00:54
User Badges:

I found out something.

It seems to be an MTU problem. Normal (default) ping is ok. Ping with -l switch, gives problems. A packet size of 214 is ok, from 215 it goes wrong..

Client is behind WLC controller btw..

Maybe the problem is on the WLC...

sachin.verma Thu, 09/17/2009 - 04:23
User Badges:


What is the version running on your WLC,as there is a know bug for MTU less than 1500 on WLC.The solution is to upgrade the controller firmware to 4.0(155)


Sachin Verma


This Discussion