Re: pix 501 inside interface not respoding until ssh attempt

rbolyard · ‎07-06-2004

Here is what I have. 14 location with the same following setup. a router connected to pix (split tunnel)the pix connected to a 2950 switch. In all locations it works great except one. Here is what happens.whats up gold tells me that the switch is down. I cannot ping it and the people inside cannot ping the inside interface on the pix. I SSH into the outside(do not even have to log in) and all of a sudden they can ping and get back out to the internet and thru the tunnel. I have changed routers, pixes, and switches and still the same thing. If i reload the pix it does not happen for a couple days. if i do not when it happens, it will continue at different times. I am syslogging the switch and the pix. Nothing from the switch except on reloads of the pix, and the pix still sends messages inside to the syslog when no one can ping it or get out. the number of messages drop but still it sends some. The magic fix is to attemp to ssh to the outside interface. When I get in the pix, the inside interface shows input errors. according to the cisco output enterp it says that over 20% of traffic on the inside interface is broadcast. What do i do? any suggestions please........

pcomeaux · ‎07-06-2004

Hey -

I have a few questions for you:

What version of Pix OS are you using?

Are you using TCP or UDP syslog?

Are you using static or dynamic IP on the outside interface of the pix?

This will help us search TAC cases, etc to try to narrow down the problem.

thanks

peter

rbolyard · ‎07-07-2004

I have 6.3.3 pix os

i believe tcp syslog

Static ip addresses on the pix and hard coded duplex and speed on the pix and switch. (Router is 2501 10/half and pix outside is 10baseT hardcoded, switch is 2950 100 full hardcoded and pix is 100 full hardcoded).

pcomeaux · ‎07-07-2004

Ok - in general, the Pix will stop forwarding traffic if the TCP Syslog server is not reachable. I do not think this is what is happening in your case, but it's worth mentioning.

By attempting your SSH session to the Pix, the router could be forced to ARP to resolve the Pix's IP address into a MAC address so it can forward the L2 packet to it.

I wonder if the problem could be in the router IOS?

Have you hard-coded the ARP entries on either the Pix or the Router for the other?

thanks

peter

rbolyard · ‎07-07-2004

no i have not, i just tried and the router gave me the following error:

Bad ARP command - Interface may only be specified when bridging IP

When I do a show arp on the pix, it only shows inside address nothing for the outside address.

any suggestion on how i should hardcode it?

rbolyard · ‎07-07-2004

Also, just to let you know, i can ping the outside interface of the pix before i ssh into it and still nothing. I have tried to telnet (which I have turned off) to it and nothing. the only way so far was to ssh to the outside and then the inside interface is pingable and people can access the internet and tunnel again.

Rick

rbolyard · ‎07-08-2004

as of 7/8/2004,, it went down again today. it has been about 2 days since the reload of the pix.

the syslog did not go in until the issue arose so thats not it.

I have changed routers, and IOS on the router.

Went down in the middle of the day when people were able to get thru it and all of a sudden could not get thru the pix or ping the inside interface. I have set arp entry on the pix manual for the router. as soon as I ssh into the pix the link was up and could ping the inside interface from a server in that location. When I first put this in it worked without any issues for a month or so. then it started and no matter what i seem to do nothing has helped. I was wondering if something on the inside is doing it. I have thought about putting a router between the pix and switch to turn off everything but unicast. but if it continues then i am hosed as i am out of ideas.

Rick

pcomeaux · ‎07-08-2004

This cannot be much fun. I am sorry this is happening.

What type of user license in on the pix 501?

Since this continues to impact your business, I would suggest opening a TAC Case at Priority 2 (if business is currently down) or 3 to see if there may be an interim engineering release that addresses your issue.

I'd refer them to the link for this conversation to show them your troubleshooting that you have already done.

thanks

peter

rbolyard · ‎07-08-2004

i have the k9 bundle unlimted users. I have a tac case number but thought not much help so far. Thought I would see if anyone else had any ideas.

Rick

ferro · ‎07-27-2004

Hi,

are u using same setup in other locations?

i mean same pix with same software rev. same switch with same software rev. and same router with same software rev.

rbolyard · ‎07-27-2004

yep, int 13 other locations. and no issues.

Friday I just put in a router between the pix and switch. so now it goes router>pix>router>switch. I did this to see if it still goes down. If it doesnt go down i know it was an inside issue. if it does, then I know its outside related. If it runs for more than 7 days without going down, i know it was an inside issue (i think).