topic Re: ASA behind PIX problems in Network Security

ASA behind PIX problems

remco.gussen — Tue, 26 Mar 2019 00:43:23 GMT

We have an ASA 5550 cluster behind a PIX 525 firewall. I'm trying to connect to the internet that is behind the PIX 525 from an inside host behind the ASA. I configured overload on the ASA outside interface (Dynamic NAT rule). The ASA outside interface is connected to the PIX 525 DMZ segment. Also, there is a Dynamic NAT rule on the PIX for overloading all DMZ addresses to the Outside PIX interface (Internet).

From my inside host i can ping addresses on the internet (www.google.nl), but a websession is not possible. On both firewalls the NAT rules are ok,firewall policies permit ip any.

I also did a test to make a static nat rule for port 3389 on the PIX and on the ASA. I tried to set up a RDP connection form the Internet to my inside host. Netstat -an on inside host display an "Established" connection on port 3389 from the Outside internet host.. On my outside Internet host, it takes 30 seconds, noting there...

I don't know where to find the solution to this problem..

Re: ASA behind PIX problems

apdatasoft — Thu, 17 Sep 2009 07:16:22 GMT

Hi,

what does the log of Pix & ASA shows.

Thanks

Re: ASA behind PIX problems

remco.gussen — Thu, 17 Sep 2009 07:54:40 GMT

I found out something.

It seems to be an MTU problem. Normal (default) ping is ok. Ping with -l switch, gives problems. A packet size of 214 is ok, from 215 it goes wrong..

Client is behind WLC controller btw..

Maybe the problem is on the WLC...

Re: ASA behind PIX problems

sachin.verma — Thu, 17 Sep 2009 11:23:39 GMT

Hi,

What is the version running on your WLC,as there is a know bug for MTU less than 1500 on WLC.The solution is to upgrade the controller firmware to 4.0(155)

thanks

Sachin Verma

Re: ASA behind PIX problems

remco.gussen — Thu, 17 Sep 2009 11:42:56 GMT

6.0.182.0

Newest version !!!