topic Re: Pix 6.3 firewall issue in Network Security

Pix 6.3 firewall issue

rogervanstone — Mon, 11 Mar 2019 19:28:59 GMT

I support an ageing pix 6.3 firewall. The ruleset on this firewall has been established forsome years now. One part of the ruleset allows inbound traffic for port 443 to an internal address. All fairly standard stuff. This rule works and can be verified. My problem is that trying to connect an iPhone to the internal host at this address, other 443 traffic (ie https) works. Replacing the pix with a draytek firewall allows the iphone to connect, so no issue with the internal host setup. Has anybody come across this issue before ?. I'm happy to post the config if required.

Regards

Roger

Re: Pix 6.3 firewall issue

Kureli Sankar — Thu, 30 Dec 2010 22:20:15 GMT

When you say other 443 traffic (ie https) works, you mean PCs and laptops are able to connect to this same inside host from outside just not the iPone?

-KS

Re: Pix 6.3 firewall issue

rogervanstone — Fri, 31 Dec 2010 09:43:15 GMT

Yes, other 443 traffic routes through ok (its a server). my only guess is that either the cisco is filtering the 443 traffic somehow (fixup http ?) or that there is secondary traffic outbound that the pix is blocking. Just though somebody might know. The only rule on the replacment draytek is an inbound 443 rule to this server. The draytek by default allows all traffic outbound except netbios stuff.

Re: Pix 6.3 firewall issue

Kureli Sankar — Fri, 31 Dec 2010 13:46:09 GMT

We need to see the logs when the iPhone fails to load the page.

conf t

logging on

logging buffered 7

exit

sh logg | i x.x.x.x ---> where x.x.x.x is the ip address of the iPhone

Captures on the pix would help as well. You can refer this link:https://supportforums.cisco.com/docs/DOC-1222

-KS

Re: Pix 6.3 firewall issue

rogervanstone — Fri, 31 Dec 2010 15:03:51 GMT

Thanks, that actually helped me a lot, it turns out that the iphone i was trying to connect was using

the internal wireless lan.........(same subnet as the pix internal)

So the pix was behaving as expected (and so was the draytek), problem solved