I have a web site protected by a set of PIX 515 that allow ports 80 and 443 to the web site. This site works fine for almost all users for both http and https. However, AOL dial-up users get a server not found error only only when they try a link that uses https (port 443), and the request never gets to the web server. Our PIX are the only things filtering traffic other than another external firewall, and I verified that it's making it through that.
One thing that is problematic is that I have not been able to get logging to work without bringing down the PIX, so I don't have any firewall logs to look at yet. I've tried UDP for syslog, which works for a short while but the PIX always overloads before I can do any useful test. I am working on this issue.
My question is: regardless of what may be in the log files (I'm reaching here...), has anyone else had problems with AOL dial-up users not getting through and if so, what was the issue?
We had a similar problem but that was when we were using the VPN client. What we did wrong was to configure an ip pool, that assigned addresses from a subnet which was also used on the internal network. This caused the internal devices to assume that the client was on the local subnet. I feel that this might be worth looking into.
The PIX is not blocking any traffic. Finally by running a packet sniffer I found that the request for web content never happens. During the TCP/IP handshake, AOL sends a SYN, we send a SYN/ACK, and then AOL never sends its ACK acknowledgement, so we never actually get a request for secure the web page.
I am still left wondering why AOL never answers. I have tried a lower MTU of 1400 all around it does not make any difference (found this tip on the web). Still looking.
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :