URL not opening ...via PIX

[yogesh.suryawanshi]

Hi All,

we have one https ulr of one of our customer...which is not opening from office... This URL is hosted over internet...

Normally we open url in two way...via enabling proxy & other is disabling proxy (just to following diff paths).

Access using any of above method does the patting over PIX 535 firewall (different pat)

This https url is not opening from Windows 7 Machines using without proxy.... but using proxy it opens.

However doing without proxy we can able to telnet to destination over port 443. that confirms we have necessry access from our source --pix to destination..

but still web open is not opening...

Yes from Win XP you use any method this url opens....

Win 7 from outside office net / other office where we have ASA firewall it opens..

Is their anythig to do with PIX...../ any method to drill this issue.

Please guide..

[yogesh.suryawanshi]

Following log is recorded on sys log which says it is MTU fragmentation issue on firewall.

Aug 16 2010 13:05:45: %ASA-4-419001: Dropping TCP packet from inside: Yogesh/63831 to outside:70.42.4.189/443, reason: MSS exceeded, MSS 256, data 536

As earlier posted , i have tried downgrading MSS to 1260 but still unable to upload page....

Also mention that physical interfaces are configured with 1500 MTU i think may be because of that MSS 1260 set by sysopt command is not taking effect...Please correct me if i am wrong here.

Now , we clear what issue is....Many Many thanks to this Forum..

I'll appreciate if you can guide how we can resolve this...

sysopt connection tcpmss 1300 & also tried sysopt connection tcpmss 1260 as well.

Do we need to use MPF here? Please guide...now we are very close to our resolution..

Thanks

Yogesh

[edadios]

With pings of 1260 set for -f appearing to work, with no errors like "Packet needs  to be fragmented but DF set."  The mtu and mss settings should really be  close enough to that value.

set the following on the pix:

mtu inside 1260

Then your mss should be less and follow

sysopt connection tcpmss 1200

Actually, according to http://www.cisco.com/en/US/tech/tk870/tk877/tk880/technologies_tech_note09186a008011a218.shtml

should be an mss of around 1220, but just try lowering until you get what works.

Also continue monitoring your logs, as they give you further idea, as you have already indicated.

If lowering the value still does not take, I suggest saving the configuration and reloading the firewall. Ensuring that you have mtu of 1260 or lower, and mss accordingly showing up after the reboot.

Hopefully it help you  get the issue resolved.

Regards,

[Kureli Sankar · Accepted solution]

https://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804c8b9f.shtml

Follow this link and add the fix to allow mss-exceed.

No need to change the MTU on the firewall.

-KS

[edadios]

Unfortunately, you can not do MPF on version 6.3 pix code.

But if you are interested in upgrading to later version of the pix code, then definitely you can consider doing that instead.

Regards,

[yogesh.suryawanshi]

Hello All,

Finally we reached to resolution by applying MPF on outside interface of ASA.

Many thanks to every one, for posting valuables inputs to reach the resolution.

Now we are able to upload page successfully.

I still have following queries; will appreciate if you can answer the same.

Q1. This behavior is observed only on ASA IOS 7.0 but not in Version 8.0.  Understand that the 7.0 release introduces several new security enhancements, one of which is a check for TCP endpoints which adhere to the advertised Maximum Segment Size (MSS). So does this mean version 8.0 IOS doesn’t have this behavior..or the MPF is already coded in version 8.

Q2. If it is coded on version 8, then it must be placed with ACL for source any & destination any. So applying any – any is harmful

Q3. In MPF we have entered the command set connection advanced-options mss-map. What does it mean?

What is difference between sysopt connection tcpmss & MPF

Regards

Yogesh S