AOL SSL traffic blocked

[jmontgom61]

I have a web site protected by a set of PIX 515 that allow ports 80 and 443 to the web site. This site works fine for almost all users for both http and https. However, AOL dial-up users get a server not found error only only when they try a link that uses https (port 443), and the request never gets to the web server. Our PIX are the only things filtering traffic other than another external firewall, and I verified that it's making it through that.

One thing that is problematic is that I have not been able to get logging to work without bringing down the PIX, so I don't have any firewall logs to look at yet. I've tried UDP for syslog, which works for a short while but the PIX always overloads before I can do any useful test. I am working on this issue.

My question is: regardless of what may be in the log files (I'm reaching here...), has anyone else had problems with AOL dial-up users not getting through and if so, what was the issue?

[drolemc]

We had a similar problem but that was when we were using the VPN client. What we did wrong was to configure an ip pool, that assigned addresses from a subnet which was also used on the internal network. This caused the internal devices to assume that the client was on the local subnet. I feel that this might be worth looking into.

[jmia]

Jeff -

From memory, I think you need to allow port 5190 for AOL connection to AOL login server - login.oscar.aol.com,

If you have ACL's applied on the inside interface try allowing the above port access out.

Let me know how you get on -

Hope this helps --

[jlepich]

try to connect via the dial-up and then do a "show log" on the pix...this should tell you if the pix is blocking anything that AOL may require....

-Jesse

[jmontgom61]

The PIX is not blocking any traffic. Finally by running a packet sniffer I found that the request for web content never happens. During the TCP/IP handshake, AOL sends a SYN, we send a SYN/ACK, and then AOL never sends its ACK acknowledgement, so we never actually get a request for secure the web page.

I am still left wondering why AOL never answers. I have tried a lower MTU of 1400 all around it does not make any difference (found this tip on the web). Still looking.