Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

AOL SSL traffic blocked

I have a web site protected by a set of PIX 515 that allow ports 80 and 443 to the web site. This site works fine for almost all users for both http and https. However, AOL dial-up users get a server not found error only only when they try a link that uses https (port 443), and the request never gets to the web server. Our PIX are the only things filtering traffic other than another external firewall, and I verified that it's making it through that.

One thing that is problematic is that I have not been able to get logging to work without bringing down the PIX, so I don't have any firewall logs to look at yet. I've tried UDP for syslog, which works for a short while but the PIX always overloads before I can do any useful test. I am working on this issue.

My question is: regardless of what may be in the log files (I'm reaching here...), has anyone else had problems with AOL dial-up users not getting through and if so, what was the issue?

4 REPLIES
Silver

Re: AOL SSL traffic blocked

We had a similar problem but that was when we were using the VPN client. What we did wrong was to configure an ip pool, that assigned addresses from a subnet which was also used on the internal network. This caused the internal devices to assume that the client was on the local subnet. I feel that this might be worth looking into.

Gold

Re: AOL SSL traffic blocked

Jeff -

From memory, I think you need to allow port 5190 for AOL connection to AOL login server - login.oscar.aol.com,

If you have ACL's applied on the inside interface try allowing the above port access out.

Let me know how you get on -

Hope this helps --

New Member

Re: AOL SSL traffic blocked

try to connect via the dial-up and then do a "show log" on the pix...this should tell you if the pix is blocking anything that AOL may require....

-Jesse

New Member

Re: AOL SSL traffic blocked

The PIX is not blocking any traffic. Finally by running a packet sniffer I found that the request for web content never happens. During the TCP/IP handshake, AOL sends a SYN, we send a SYN/ACK, and then AOL never sends its ACK acknowledgement, so we never actually get a request for secure the web page.

I am still left wondering why AOL never answers. I have tried a lower MTU of 1400 all around it does not make any difference (found this tip on the web). Still looking.

140
Views
0
Helpful
4
Replies
CreatePlease to create content