PIX515 vers6.2(2) problem with mailguard disgarding packet

[syves]

Dear All

I have a problem with my smtp connection through my PIX vers 6.2(2). I found that if an aknowledgement packet is lost before getting to the PIX the retransmission of the packet is not recognise.

Below is the debug fixup tcp result.

Any ideas why Mailguard is droping the retransmited packet.

REgards Yves

smtp_response: (MBEXCHNT1/25 -> MBSITS2K3/4674)

smtp_cmd: (MBEXCHNT1/25 <- MBSITS2K3/4674)

smtp_cmd: initial cmd = helo , enter reply mode

smtp_response: (MBEXCHNT1/25 -> MBSITS2K3/4674)

entering command mode

smtp_cmd: (MBEXCHNT1/25 <- MBSITS2K3/4674)

smtp_cmd: cmd = mail entering reply mode

smtp_response: (MBEXCHNT1/25 -> MBSITS2K3/4674)

entering command mode

smtp_cmd: (MBEXCHNT1/25 <- MBSITS2K3/4674)

smtp_cmd: cmd = rcpt entering reply mode

smtp_response: (MBEXCHNT1/25 -> MBSITS2K3/4674)

entering command mode

smtp_cmd: (MBEXCHNT1/25 <- MBSITS2K3/4674)

entering reply moded = data

smtp: DATA cmd, waiting for acceptance

smtp_response: (MBEXCHNT1/25 -> MBSITS2K3/4674)

entering command mode

begin mail

smtp_data: data transfer complete, awaiting reply

!**********************************

!the original 250 OK packet is lost the following

!entry is the retransmission packet for the "250 OK"

!acknowledgement of the end of the email

!************************************

tcpseq: rexmit packet seq=756258381, snd_next=756258389, window (756258381-756323639)

!***********************************

!Mailguard discard the 250 OK retransmission

!***********************************

smtp_response: (MBEXCHNT1/25 -> MBSITS2K3/4674)

discarding old reply

packet: <250?OK\r\n>

tcp: ERR: fixup on flags <1000> fails

[scoclayton]

I suspect you might be running into a side effect of a known issue - CSCeb33762.

Any chance you would consider an upgrade to 6.2(4) and try your test again? If this does not work, I would suggest getting a trace of the session from the outside interface on the PIX along with the corresponding 'deb fixup tcp' output and opening a service request with the experts in TAC.

Sorry I cannot offer more assistance.

Scott