I have a pix quandry. I am looking for suggestions on how to fix what appears to be a file transfer latency issue from dmz to dmz.
I have an environment that includes multiple dmzs with application traffic between the dmzs. All appears to be well ACCEPT for when we attempt to do an application upgrade/install. When this occurs what is normally a two second install in an non-firewall environment becomes a 400+ second install in the firewall environment.
The install is hanging on a file transfer. The install is initiated from a server on the Security10 interface, however the msi package is pulled from a server on the Security15 interface. We also tried making the msi package a text file; there was no significant difference in transfer speed.
We have added the appropriate port access list on the Security10 interface. We verified that there were no deny statements prohibiting the traffic on the Security15 interface.
I also sniffed the packet stream during the install on both ends and was able to pair up most of the tcp conversations fairly easily although I did notice at the beginning of the tcp conversation rather more SYN packets then I would have normally expected.
I also used a portmapping tool to verify that channel was open between both hosts. It clearly showed the conversation was initiating. And eventually although rather slowly the app was pulled over.
To make things more interesting we placed both servers on the same switch with no firewall between them and the install was less than two seconds.
To make things even more interesting, I took the majority of the firewall config from the production environment and built a test environment around it and the application install works just fine. Less than two seconds. I should note that I don't have the whole production config. Just the rules-set. It is managed by a third party. And yes, I am working on getting the complete rules set. I did do a line by line comparision of the pix configs with the third party on the data that I was missing and they had nothing addition to add.
The test environment has one major difference. It was 6.2(2) on a Pix 520 whereas the production environment was a failover config with two Pix 515 running 6.2(2)111. I wasn't able to find anything relevant on bug track.
Any suggestions on how to track this down?
Patrick
