topic Dropped packet between PIX in Network Security

Dropped packet between PIX

yann.boulet — Mon, 11 Mar 2019 11:27:27 GMT

hello,

i have some dropped packets between 2 PIX first one is PIX 525 V7 and second one is PIX 520 V6.3, there is a cisco catalyst to connect them and i can see dropped packets only on the PIX 525, how can i troubleshoot it ?

The problem is when i access to an https application behind the PIX 520 and to PDM on it, i can't display some pages and on PDM i have some time PDM was unable to contact the PIX, but for the SSH connection i have no issue.

Thank you

Re: Dropped packet between PIX

rsrivast — Fri, 19 Oct 2007 07:20:07 GMT

hello

thanks for the question. I have posted the question to internal PIX team and will let you know when I hear an answer. I suggest to check http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/

for more details, since this is mainly IOS security discussion.

thanks

Re: Dropped packet between PIX

yann.boulet — Fri, 19 Oct 2007 07:27:50 GMT

thank you, i will try to check the link you suggest me

Re: Dropped packet between PIX

yann.boulet — Wed, 24 Oct 2007 14:04:50 GMT

hi,

there is no news since my post ?

thx

Re: Dropped packet between PIX

Tue, 30 Oct 2007 15:37:04 GMT

try to use the norandomseq keyword on your 6.3 PIX with the

"static (inside,outside) netmask norandomseq"

command to try to solve this problem and to stop the PIX from offsetting the TCP sequence number. this might help if "both" devices scramble tcp sequence numbers.

Re: Dropped packet between PIX

p-allen — Sat, 03 Nov 2007 14:25:36 GMT

sounds like a simalar issue we are having. We use a ASA firewall that connects to our isp which also uses a firewall and are seeing alot of out of order packets. We are mainly seeing the issue with one website that sometimes everything is fine and other times we get alot of page can not be displayed. The site is saying that no one else is having an issue but us. The ISP is saying that they also see alot of out of order packets for our connections to the internet. I am wondering if this could be our issue also.

Re: Dropped packet between PIX

excession — Sat, 03 Nov 2007 18:06:25 GMT

Hi Yann,

Could you describe your topology a little more? From what I understand you have the following.

PDM-----PIX525---CAT---PIX520

Does this issue only happen appear for https?

Is this a new setup or were there changes made recently?

How can you see the dropped packets?

In order to troubleshoot this issue I suggest you get captues on the PIX525 and see what exactly is being dropped. See the following link for details on the capture command

http://www.cisco.com/en/US/docs/security/asa/asa70/command/reference/c.html#wp1950270

Note you can capture based on "type asp-drop".

You could try to run a "show asp drop" before you experience the problem, the run it again after trying to display the pages you are having problems with and see what counter is increasing.

Have you Syslog? What level are logs enabled at? Maybe you could also check these logs to identify what is being dropped.Check the logs before and after a session.

Re: Dropped packet between PIX

sachin.verma — Tue, 06 Nov 2007 04:25:01 GMT

Hi yann,

It looks like mtu size issue to me.Kindly check the mtu size defined on the outside and inside interfaces on pix 525 and pix 520 connecting each other on switch.

regards

Sachin Verma