I am enabling the IPS functionality on a 3825 router with IOS 12.4(3d). The problem is that when I enable the IPS (inbound direction of the router's ethernet interface) I start having connectivity problems with some applications even with all the signatures on alert (not to drop traffic).
Is there a debug or some troubleshooting that I can use in order to verify why the IPS is dropping some of the traffic?
Also I have read that when you enable the IPS functionality the router automatically activates de inspect engine and in consequence it will drop out-of-order packets and half open connections, is this correct?
I will try the IOS upgrade to see if that helps me to solve the issue, by the way I am still looking for some debugs or troubleshooting commands that help me to verify that the IPS (and inspect engine) is dropping the packets. Do you know some commands or debugs that can help me?
Yes. The module/doe that drops out-of-order packets belongs to the firewall session tracking function. If you use 'debug ip inspect detail' command, you should be able to find clue. Be careful not to use this command on your production network, this debug command will generate lots of messages.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...