topic Re: Pix 506E - clients http dont see some websites in Network Security

Pix 506E - clients http dont see some websites

hk47jr — Mon, 11 Mar 2019 22:36:07 GMT

Hello everyone,

I have a problem with PIX 506E that meets the version 6.1, and in an simple computer network equipment seems to behave in strange ways because some web sites do not open or very open slow thereby its operation impracticable. On the other hand other web sites open normally.

Querying the web site of the Cisco, I found several documents discussing the same problem but in a later version ( 7.0 ), not in this version 6.1.

I've tried removing the pix from the network , not the error occurred, again insert pix however tested only with a machine, without the rest of the network and the problem persists.

Can anyone help me find and solve this problem?

Pix 506E - clients http dont see some websites

Kimberly Adams — Tue, 28 Feb 2012 18:32:18 GMT

Can you please post your configuration, it may help us to see it and then be better armed to help you.

Thanks,

Kimberly

Re: Pix 506E - clients http dont see some websites

hk47jr — Tue, 28 Feb 2012 19:09:05 GMT

Ok, follows the attached file for your review.

Thank You.

Jose

De: kadams@gbrx.com supportforums-donotreply@supportforums.cisco.com

Enviada em: terça-feira, 28 de fevereiro de 2012 15:32

Assunto: Re: Pix 506E - clients http dont see some websites - Re: Pix 506E - clients http dont see some websites Re: Pix 506E - clients http dont see some websites

Home<https://supportforums.cisco.com/index.jspa>

Re: Pix 506E - clients http dont see some websites

created by Kimberly Adams<https://supportforums.cisco.com/people/kadams%40gbrx.com> in Firewalling - View the full discussion<https://supportforums.cisco.com/message/3574389#3574389

Re: Pix 506E - clients http dont see some websites

hk47jr — Mon, 05 Mar 2012 13:26:44 GMT

Mr. Kimberly,

You have news about this issue ?

Thank You

Jose

Pix 506E - clients http dont see some websites

Kimberly Adams — Mon, 05 Mar 2012 20:45:22 GMT

Jose,

I couldn't find your attached configuration. Can you just paste into the forum?

Thanks,

Kimberly

Re: Pix 506E - clients http dont see some websites

hk47jr — Tue, 06 Mar 2012 11:22:35 GMT

OK I Attached configuration again.

Thanks a lot.

Jose

De: kadams@gbrx.com supportforums-donotreply@supportforums.cisco.com

Enviada em: segunda-feira, 5 de março de 2012 17:46

Assunto: Re: Pix 506E - clients http dont see some websites - Re: Pix 506E - clients http dont see some websites Re: Pix 506E - clients http dont see some websites

Home<https://supportforums.cisco.com/index.jspa>

Re: Pix 506E - clients http dont see some websites

created by Kimberly Adams<https://supportforums.cisco.com/people/kadams%40gbrx.com> in Firewalling - View the full discussion<https://supportforums.cisco.com/message/3579291#3579291

Re: Pix 506E - clients http dont see some websites

david.tran — Tue, 06 Mar 2012 12:06:21 GMT

Please set the mtu on both inside and outside to 1500. I think that will solve your problem:

mtu outside 1500

mtu inside 1500

are there any reasons why you need it to be at 2000?

Re: Pix 506E - clients http dont see some websites

hk47jr — Tue, 06 Mar 2012 12:12:35 GMT

Hi David, thank for your help.

Interfaces in the value it was this, and had the same problem I changed the value to 2000, as a test, the chance to solve the problem. But unfortunately it still fails, and let the current value.

Regards,

Jose

De: david.tran@finra.org supportforums-donotreply@supportforums.cisco.com

Enviada em: terça-feira, 6 de março de 2012 09:07

Assunto: Re: Pix 506E - clients http dont see some websites - Re: Pix 506E - clients http dont see some websites Re: Pix 506E - clients http dont see some websites

Home<https://supportforums.cisco.com/index.jspa>

Re: Pix 506E - clients http dont see some websites

created by david.tran@finra.org<https://supportforums.cisco.com/people/david.tran%40finra.org> in Firewalling - View the full discussion<https://supportforums.cisco.com/message/3579789#3579789

Re: Pix 506E - clients http dont see some websites

david.tran — Tue, 06 Mar 2012 12:20:17 GMT

try this, remove "fixup protocol http 80", it is nothing but trouble:

no fixup protocol http 80

Re: Pix 506E - clients http dont see some websites

hk47jr — Tue, 06 Mar 2012 12:26:30 GMT

Hi David,

In another test before I realized, I had taken this command no fixup protocol http 80 ,but the problem persist. It is somenthing really unusual, never seen such a problem.

Jose

Re: Pix 506E - clients http dont see some websites

david.tran — Tue, 06 Mar 2012 12:34:03 GMT

then I am out of idea, unless you want to give it another try, I don't think it will work, but what the hell:

access-list external permit icmp any any log

access-list external permit ip any any log

access-group external in interface outside

access-list capture permit ip any any

capture external access-list capture interface outside

capture internal access-list capture interface inside

Not sure if version 6.1.(4) support capture. Then use wireshark to see why it fails for some sites

Re: Pix 506E - clients http dont see some websites

hk47jr — Tue, 06 Mar 2012 12:43:37 GMT

Well I think we have no chance, I will schedule and I will capture the packets from network to see what really happens, I respond with the results.

Thank you all up to date.

Re: Pix 506E - clients http dont see some websites

david.tran — Tue, 06 Mar 2012 13:11:53 GMT

Here is my 2c. on this:

Even if you confirm that this is a Pix issue, you don't have much of a choice because your next option is ASA.

Why not just bite the bullet now and get an ASA5505 and give it another try. If it does not work, you can open a case with TAC and get a fix.

There is no point of playing with a code that is no longer supported.

Re: Pix 506E - clients http dont see some websites

hk47jr — Thu, 26 Apr 2012 14:50:47 GMT

Anybody, the solutions is change PIX. thank you for all