topic CBAC blocking Windows 7 upload in Network Security https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855544#M488655 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>The thing is that reassembly is for the out of order packets not out of sequence,</P><P></P><P>I will investigate on this and let you know.</P><P></P><P>Julio</P></BODY></HTML> Sat, 14 Jan 2012 19:27:17 GMT Julio Carvajal 2012-01-14T19:27:17Z CBAC blocking Windows 7 upload https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855539#M488647 <P>Hello,</P><P></P><P>Since upgrading some of computers in my LAN to Windows 7 they all experience upload issues. I have narrowed it down to CBAC inspection on my Cisco 1711 router, I am running IOS 12.3 I have a simple CBAC inspection set for TCP/UDP only without any application-specific inspects. Download works fine however upload does not seem to work atl all- unless I disable the ip inspection. It is all working fine for any Windows XP but not for Windows 7 machines. Is this a known issue, I am not sure how I can go about this - I don't want to build ACLs now for outside interface and disable stateful inspection mechanisms because CBAC has been working fine for me until recently. Thanks for any suggestions. </P> Mon, 11 Mar 2019 22:14:18 GMT https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855539#M488647 arturkociola 2019-03-11T22:14:18Z CBAC blocking Windows 7 upload https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855540#M488649 <HTML><HEAD></HEAD><BODY><P>Hello Artur,</P><P></P><P>Can you show us the the logs CBAC is reporting while you make an upload.</P><P></P><P>You can enable the command "ip inspect log drop-pkt"</P><P></P><P>Regards,</P><P></P><P>Julio</P></BODY></HTML> Sat, 14 Jan 2012 17:11:51 GMT https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855540#M488649 Julio Carvajal 2012-01-14T17:11:51Z Re: CBAC blocking Windows 7 upload https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855541#M488650 <HTML><HEAD></HEAD><BODY><P>Thank you Julio, what sort of logs would you like to see? I set the:</P><P> <STRONG>ip inspect log drop-pkt</STRONG></P><P>and also</P><P><STRONG>debug ip insp tcp</STRONG></P><P><STRONG>debug ip insp udp</STRONG></P><P><STRONG>debug ip insp event</STRONG>s</P><P>and I am attaching the exract when I initiated http upload. It looks like the packets are dropped because they're out of sequence, I was trying to upload to ip 87.248.121.213 (flickr in this case). </P></BODY></HTML> Sat, 14 Jan 2012 19:04:10 GMT https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855541#M488650 arturkociola 2012-01-14T19:04:10Z Re: CBAC blocking Windows 7 upload https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855542#M488651 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>That is the issue! CBAC will do a deep inspection on the TCP stack and it will see the out of order packets and will drop them, You will need to solve that problem on the inside on your network ( packets out of order) but at this moment CBAC is doing its job.</P><P></P><P>Regards,</P><P></P><P>Julio</P></BODY></HTML> Sat, 14 Jan 2012 19:13:37 GMT https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855542#M488651 Julio Carvajal 2012-01-14T19:13:37Z CBAC blocking Windows 7 upload https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855543#M488653 <HTML><HEAD></HEAD><BODY><P>Well, this is Windows 7, how can I force it? Again, I don't have this problem with Windows XP. It looks like the issue was addressed with newer IOS version with <STRONG>ip insp tcp reassembly</STRONG> command. </P><P><A href="http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_ooop.html">http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_ooop.html</A></P></BODY></HTML> Sat, 14 Jan 2012 19:19:25 GMT https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855543#M488653 arturkociola 2012-01-14T19:19:25Z CBAC blocking Windows 7 upload https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855544#M488655 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>The thing is that reassembly is for the out of order packets not out of sequence,</P><P></P><P>I will investigate on this and let you know.</P><P></P><P>Julio</P></BODY></HTML> Sat, 14 Jan 2012 19:27:17 GMT https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855544#M488655 Julio Carvajal 2012-01-14T19:27:17Z CBAC blocking Windows 7 upload https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855545#M488657 <HTML><HEAD></HEAD><BODY><P>Thank you Julio but I found the solution - it was IOS upgrade. When I ugraded my 12.3-11 to 12.4-15 it started to work on exactly the same configuration, I did not change anything. </P></BODY></HTML> Sat, 14 Jan 2012 22:18:34 GMT https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855545#M488657 arturkociola 2012-01-14T22:18:34Z CBAC blocking Windows 7 upload https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855546#M488658 <HTML><HEAD></HEAD><BODY><P>Hello Artur,</P><P></P><P>Really, sounds like a bug, I will search on this to find what is going on.</P><P></P><P>Thank you for the update.</P><P></P><P>Please mark the question as answered so future users with the same issue now what to do.</P><P></P><P>Regards,</P><P></P><P>Julio</P></BODY></HTML> Sat, 14 Jan 2012 22:22:32 GMT https://community.cisco.com/t5/network-security/cbac-blocking-windows-7-upload/m-p/1855546#M488658 Julio Carvajal 2012-01-14T22:22:32Z