We recently upgraded a PIX from version 7.1(2) to 7.2(1) due to problems with the inspection engine. Since the upgrade we have not been able to telnet to machines behind the firewall through a site to site VPN tunnel.
before the upgrade everything worked fine, after the upgrade, nothing. We get the same problem with VPN Tunnels from version 6.3(4) and version 7.0(4) firewalls.
I found a document about this problem (Document ID: 6370 - PIX Performance Issues Caused by IDENT Protocol) which suggests turning on the "service resetinbound" command (tried, but no change) and we have tried turning off the IDENT requirements on our 6509's (couldn't find the command), but this is not really a viable options due to the large number of devices from various manufacturers that we have. The third option sounds like too much of a security risk to me.
We have several PIX that I want to upgrade from 7.0(4), but until we fix this problem I can?t proceed. Has anyone else experienced this problem, if so how did they fix it?
Cheers
Bruce
