topic PIX Connection Problem in Network Security

PIX Connection Problem

msanford3755 — Mon, 11 Mar 2019 11:01:14 GMT

I may be missing something obvious, but would appreciate some help.

I'm attempting to establish new connectivity to an inside server from an outside vendor. The traffic is being denied with no connection as soon as the conversation is initiated. I can see the entry in the conn table while the connection is being refused. Messages in log:

302013: Built inbound TCP connection 479966211 for dmz_vendor:a.b.c.d/52249 (a.b.c.d/52249) to inside:1.2.3.4/80

106015: Deny TCP (no connection) from 1.2.3.4/80 to a.b.c.d/52249 flags SYN ACK on interface inside

The deny is the very next message in the log, so there is no delay. At the same time, I was showing the conn table (repeatedly) and saw:

ibk-pix-firewall# sh conn local 1.2.3.4

1808 in use, 5550 most used

TCP out a.b.c.d:52249 in 1.2.3.4:80 idle 0:00:03 Bytes 0 flags SaAB

ibk-pix-firewall# sh conn local 1.2.3.4

1820 in use, 5550 most used

TCP out a.b.c.d:52249 in 1.2.3.4:80 idle 0:00:06 Bytes 0 flags SaAB

ibk-pix-firewall# sh conn local 1.2.3.4

1794 in use, 5550 most used

TCP out a.b.c.d:52249 in 1.2.3.4:80 idle 0:00:13 Bytes 0 flags SaAB

ibk-pix-firewall# sh conn local 1.2.3.4

1788 in use, 5550 most used

TCP out a.b.c.d:52249 in 1.2.3.4:80 idle 0:00:14 Bytes 0 flags SaAB

So I don't understand why the outgoing packet is being denied for no connection, when the entry is in the conn table. Any ideas?

Re: PIX Connection Problem

JORGE RODRIGUEZ — Wed, 22 Aug 2007 15:05:17 GMT

Mike, could you post the access list for others to see, strip out public ip info, are you natting from the dmz to the inside if so is the vendor connecting to the nat address instead of your local host IP?

Re: PIX Connection Problem

rigoberto.cintron — Wed, 22 Aug 2007 15:43:46 GMT

Do you have ACL's restricting traffic inbound at the inside interface?

Re: PIX Connection Problem

anandramapathy — Thu, 23 Aug 2007 12:25:42 GMT

hi ensure that the following are present.

1. static NAT for the private IP to a public IP

2. access list on the outside allowing http access to the Public IP of the server ( as above )

3. Access group has been applied on the outside interface : )

4 route available to the inside & outside interfaces.