topic Re: How to identify is PIX is culprit? in Network Security

How to identify is PIX is culprit?

mpiaser — Mon, 11 Mar 2019 10:31:19 GMT

I just installed Small Business Server 2003 and am using it for Email (exchange) services. OWA works great inside the network but it is so slow outside the network that I know something is wrong. How can I identify if it is something in the PIX 501 firewall causing the issue? I can't just take the PIX off the T1 since it is doing Network Address Translation. Please give me ideas, I'm working this weekend and desparate to solve the problem.

Re: How to identify is PIX is culprit?

Jon Marshall — Sat, 16 Jun 2007 11:30:06 GMT

When you say outside the network do you mean across the Internet or just from the outside of the pix.

Firstly check the speed/duplex of your pix interfaces and the switch ports they are connected into.

Secondly, if you could temporarily allow ip from your source address outside the pix to the SBS and see if that makes a difference. If it does it may be that you need to open additional ports for OWA to work more smoothly.

HTH

Jon

Re: How to identify is PIX is culprit?

mpiaser — Sat, 16 Jun 2007 16:06:02 GMT

I mean accross the internet. I'm not sure how to just be outside the PIX without being on the internet. I guess I could plug a PC directly to the PIX or something to be outside.

If there was a way to see what the PIX is blocking, perhaps that would clarify the issue.

If I took the PIX out of the configuration, I think I'd have a problem as the PIX is doing address translation.

Re: How to identify is PIX is culprit?

Jon Marshall — Sat, 16 Jun 2007 16:25:03 GMT

Okay, well the Internet is a huge variable in itself so compared to preformance on the LAN it is always going to seem slow.

You don't need to take the pix out of the configuration.

1) Identify your source IP address when you connect across the Internet

2) Add a rule to your pix allowing all ip from that IP address to your SBS server ie.

access-list acl_outside permit ip host "your source address" host "SBS NAT address"

alternatively you can add a rule at the end of your access-list

deny ip any any log

which will show which ports are being blocked but you may be getting so many hits that you can't see much.

Jon

Re: How to identify is PIX is culprit?

mpiaser — Sat, 16 Jun 2007 16:53:24 GMT

How do I see the logged entries in the PIX?