topic Re: Large Ping Packets Dropped (PIX) in Network Security

Large Ping Packets Dropped (PIX)

murphyw — Fri, 21 Feb 2020 09:06:21 GMT

Hi everyone,

I am hoping someone can point me in the right direction here. I have just plugged in a Pix 535 (with an allow ip any any access list on all interfaces) into the core of our network. I have also configured it to not do any NAT's and purely route (same-security-traffic permit inter-interface & no nat control).

I have noticed that now the new firewall is in place, i cannot ping through the firewall with packets larger then 1473bytes. I am just wondering if this is normal behaviour and/or could it cause any performance issues ?

(i have just noticed if i do a ping to x.y.z.254 [router] with 1500bytes, it works ok. If i do x.y.z.200 [client] it only works to 1472bytes then starts failing)

Thanks very much in advance.

Re: Large Ping Packets Dropped (PIX)

eh2os — Thu, 10 Aug 2006 14:03:58 GMT

Not sure this is the same thing, but the IDS functionality of the PIX IOS drops packet above a certain size due to security concerns. I could not pass packets about 993bytes or something like that on PIX 506E's running 6.3.4 until I disable a couple of the ip attacke audit blah blah blah lines. Just a thought.

Eric Watters

Atlanta, Ga.

Re: Large Ping Packets Dropped (PIX)

murphyw — Tue, 15 Aug 2006 14:45:42 GMT

Thanks for you reply, it apears to be doing the same issue even routing through a layer 3 switch instead. Not to worry, bigger issues now 🙂