Re: PIX 515E Unable to access certain external web sites

B.Warford · ‎01-12-2004

We recently implemented PIX515E appliances on our network. Since the conversion, we are unable to access certain websites. Whenever we try, we get the dreaded "Page not found" message. If we use a PC that we have set up outside the firewall, we're good to go. One of the sites we have trouble with is http://patft.uspto.gov/netahtml/srchnum.htm

We have a TAC case open with CISCO, but 6 weeks later all we have gotten is two new TAC reps. They are unable to figure out this issue as well.

We have sent syslogs and packet captures to them to no avail. Has anyone else had a similar issue? There appears to be no problem with our config according to CISCO.

Any help you could provide would be appreciated.

scoclayton · ‎01-12-2004

Please post the TAC case number and I will have a look at the data gathered to this point. Not saying I will have an answer for ya but another set of eyes should help. Sorry for the problems.

Scott

B.Warford · ‎01-13-2004

Scott,

Thanks for what ever help you can supply. The case number is:E778298

Thanks again,

Brian

jmia · ‎01-13-2004

Hi Brian,

Can you post your PIX config please either here or if you like off-line to me (jmia@ohgroup.co.uk). I actually accessed that web site you mentioned via my PIX 515 with no problem, so would be interesting to see and compare your config with the one I have here on my Lab PIX.

Please remember to change Real IP's and passwords.

Thanks - Jay.

B.Warford · ‎01-14-2004

Thanks for all your help Jay. We really appreciate it. We have our DNS guys working to resolve the issue now.

jmia · ‎01-15-2004

Brian,

No problem, glad to be of help. If you need further help or assistance the e-mail me at: noc1@vodafone.net

Kind Regards,

Jay.

scoclayton · ‎01-15-2004

Alright, I am curious now. Care to enlighten us on the resolution? I looked through the case notes fairly quickly but did not see anything that jumped out at me.

Scott

B.Warford · ‎01-16-2004

After discussing the DNS issue with our Network group, we have determined that the DNS server is indeed resolving correctly. We are target our routers now as this piece of equipment is the only one left.

We have also discovered that we are unable to reach ANY websites in the 164 IP range.

Additionally, we are having issues with our MSN Messenger. We have clients who are continuously connected but periodically (not on a regular basis) we see them sign in even though they never sign out. We are beginning to think we have a gremlin here.....

Brian