Greetings. This is a very strange problem. I installed a Cisco PIX 525 two months ago, and it is working great. However, a customer came in this morning and reported he is unable to create new Hotmail accounts. Apparently, this has been going on for some time. We can create them successfully when we bypass the PIX, but we cannot create them successfully when we go through the PIX. We can do everything else, it seems, including online banking, VPN, etc. We can even log into existing Hotmail accounts. However, we cannot create new ones. I ran WireShark, and the packets come back marked "TCP Checksum Incorrect." What could be causing this? Here is my config:
PIX Version 8.0(3)
!
hostname pix525
domain-name **********
enable password ************* encrypted
names
!
interface Ethernet0
description To Cisco 2821 fa0/3/0
speed 100
duplex full
nameif outside
security-level 0
ip address ***.***.***.*** 255.255.255.248
!
interface Ethernet1
description To Outside Switch fa0/7
speed 100
duplex full
nameif inside
security-level 100
ip address ***.***.***.*** 255.255.0.0
!
passwd ********* encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name ***********
access-list acl_outbound remark BLOCK OUTBOUND PORT 25
access-list acl_outbound extended permit tcp any host ***.***.***.*** eq smtp
access-list acl_outbound extended deny tcp any any eq smtp
access-list acl_outbound extended permit ip any any
pager lines 24
logging buffer-size 10000
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit host ***.***.***.*** outside
icmp deny any outside
icmp permit host ***.***.***.*** inside
icmp deny any inside
no asdm history enable
arp timeout 14400
global (outside) 1 ***.***.***.*** netmask 255.255.255.255
nat (inside) 1 ***.***.***.*** 255.255.0.0
access-group acl_inbound in interface outside
access-group acl_outbound in interface inside
route outside 0.0.0.0 0.0.0.0 ***.***.***.*** 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
dhcprelay server ***.***.***.*** inside
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect xdmcp
inspect pptp
inspect mgcp
!
service-policy global_policy global
prompt hostname context
I have searched the Internet and found other folks complaining of the same problem, but they were all endusers, and did not have a resolution.
Ideas? Comments? Suggestions? Helpful criticism?
Thank you for your time.
