CE560 and PIX

[admin_2]

Has anyone had problems implementing a CE560 that sits behind a PIX? I am installing a CE560 that is speaking WCCP2 with a Catalyst 6509. All web traffic travels from the clients to the 6509, to the CE560, back to the 6509, through a PIX and on to the web (assumimg that the page was not cached). The problem I have is that the when the cache engine is used the Firewall logs increase from 10MB daily to 80MB daily. All of the PIX syslogs are Deny TCP connection due to no matching entry in the state table. All of the messages are to or from the CE560. Web traffic itself does not seem to be affected. It just causes the PIX logs to grow so large that they are unmanageable.

Thanks,

Kevin

[pgolding]

does the cache have a public to private static translation in the pix? might be better if it does.

but, the problem you see may be related to the way the pix closes sessions once a FIN packet is seen. you can alter this behavior with the pix command "sysopt connection timewait", so try adding or removing this command and see if it stops the deny messages.