Pix TCP Resets

[jmcmasters]

I have a Pix 525 with multiple DMZ's. Behind one of the DMZ's lies my public interface of a traffic mitigation server. Fron this interface the server sends out TCP resets for P2P traffic to save upstream bandwidth. I am seeing that the pix is preventing alot of these resets as when I remove the server from behind the firewall I can see the resets. Is there something that I need to add to allow these connections out? Or is there debugs I can run to see these being stopped?

Thanks

Jeremy

[wong34539]

The TCP reset action is only appropriate as an action selection on those signatures associated with a TCP-based service. If selected as an action on non-TCP-based services, no action is taken. Additionally, TCP resets are not guaranteed to tear down an offending session because of limitations in the TCP protocol. Make ACL changes to block traffic on routers (or PIX Firewall or Cisco Catalyst 6000 switches) that the sensor manages, using the command and control interface