topic Re: Allowing TCP options 24-31 on PIX v6.x in Network Security

Allowing TCP options 24-31 on PIX v6.x

marioderosa2008 — Mon, 11 Mar 2019 14:21:04 GMT

Hi all,

having trouble with the PIX firewall stripping the TCP options as traffic passes through. We have Citrix WAN scalers that use these options to accelerate TCP connections.

Can any one advise of the syntax to do this?

Does anyone know if PIX v7 command syntax differes from PIX v6 ?

I have command syntax for v7 below, but this does not seem to be accepted on our PIX 6 firewall.

pixfirewall(config)#access-list tcpmap extended permit tcp any any

pixfirewall(config)# tcp-map tcpmap

pixfirewall(config-tcp-map)# tcp-opt range 24 31 allow

pixfirewall(config-tcp-map)# exit

pixfirewall(config)# class-map tcpmap

pixfirewall(config-cmap)# match access-list tcpmap

pixfirewall(config-cmap)# exit

pixfirewall(config)# policy-map global_policy

pixfirewall(config-pmap)# class tcpmap

pixfirewall(config-pmap-c)# set connection advanced-options tcpmap

Thanks again guys!!

Re: Allowing TCP options 24-31 on PIX v6.x

marioderosa2008 — Thu, 04 Dec 2008 16:41:04 GMT

can i please have some advice on this...?

has no one come accross this kind of problem before?

Does any one know whether TCP policy mapping can be done on PIX v6.0?

Re: Allowing TCP options 24-31 on PIX v6.x

Tom.Weast — Thu, 04 Dec 2008 16:59:20 GMT

We just ran into this exact problem today. One wanscaler was behind a PIX 6.3 firewall, and the other behind an ASA with version 7.X.

We found that the version 7 needed the above configuration, but the version 6 did not.

I could not find anywhere to set TCP Options in a PIX 6.X firewall. But as soon as we did the config on the 7.X firewall, it immediately started working end-to-end.

Re: Allowing TCP options 24-31 on PIX v6.x

ajagadee — Thu, 04 Dec 2008 17:10:32 GMT

Mario,

There is a difference between Pix 6.x and 7.x. In Pix 6.x. all TCP options should pass unchanged. But, in Pix 7.x, you need the above commands to make Citrix work.

Regards,

Arul

*Pls rate if it helps*

Re: Allowing TCP options 24-31 on PIX v6.x

marioderosa2008 — Thu, 04 Dec 2008 17:20:11 GMT

thanks for the reply.

It has helped me rule out that the PIX firewall is not cauring the issue...

thanks again!

Re: Allowing TCP options 24-31 on PIX v6.x

Tom.Weast — Thu, 04 Dec 2008 17:20:44 GMT

Please see the other replies on this, but no there is no way to do policies like this in 6.X like there is in 7.X. For us, it was not needed in 6.X, it just worked. We did require the change on the 7.X side.

Re: Allowing TCP options 24-31 on PIX v6.x

ajagadee — Thu, 04 Dec 2008 17:25:09 GMT

Mario,

Your welcome. If the above posts resolves your issue, could you please update the forum that it resolved the issue and also rate if possible.

Thanks,

Arul

Re: Allowing TCP options 24-31 on PIX v6.x

ajagadee — Thu, 04 Dec 2008 18:56:11 GMT

Mario,

There is a difference between Pix 6.x and 7.x. In Pix 6.x. all TCP options should pass unchanged. But, in Pix 7.x, you need the above commands to make Citrix work.

Regards,

Arul

*Pls rate if it helps*

Re: Allowing TCP options 24-31 on PIX v6.x

mkohlschmidt — Mon, 31 Aug 2009 09:48:45 GMT

I run into the same problem. Can u confirm 100% that pix 506 with 6.3(5) doesnt strip tcp options?