Windows Server 2008 and PIX packet dropping?

[ben.maccagnan]

Hello Everyone,

I have a very odd situation here and I was wondering if anyone could provide some insight as to what the root cause might be or in this case might have been.  I came across a situation where a client had an old PIX 525 running PIX 6.2.  There was a Windows 2008 R2 server running Exchange 2010 that was having trouble delivering email to a handful of email servers.  We then found out that we could telnet to these servers on port 25 but got no return traffic.  We then went back the old email server that was running Windows 2003 Server and could telnet to port 25 on these email servers and got a response, saw the banner and could issue commands.  The first thought was reverse DNS which we thoroughly checked and it was not.  I turned off the smtp fixup protocol and that didn't fix it either.  From workstations on the network running XP or Windows 7 or Linux you could telnet to these servers and you would get a response but just not with 2008 server.  I spent hours on the phone with Cisco support and it was determined that the packets were returning and we could capture the packets on the outside interface but they were then dropped by the firewall.  Using the 6.2 version of PIX we could not determine why the packets were being dropped.  I suggested upgrading to the next major version to be able to troubleshoot the issue further.  We then upgraded the PIX to version 7.0(8).  After the upgrade we were able to telnet to the problem mail servers from Windows 2008 Server and there were no issues.  Does anyone know why this problem occurred in the first place?  Is there a know issue with Windows 2008 Server and PIX 6.2? 

[Kureli Sankar]

Ben,

I have not heard of that. If you can provide me with a case nubmer I can look that up and review the packet capture attached to the case.

on the ASA we have asp drop capture that will tell us the reason for packets dropped. On the old PIX code there is no such drop captures that we can configure.

without any frixup, it should be treated like any other tcp traffic and should have recd. the packets on the outside and sent them to the inside.  I have no idea why these were dropped.

-KS