Extremely Slow Internet with Pix Firewall

[stampro22]

I have a customer who recently upgraded to T1 access. We initially installed a Linksys firewall behind the Cisco router installed by the phone company but found that every 3rd or 4th time that we opened Internet explorer or tried to access the Internet, the (I assume DNS resolution) was so slow that it timed out. I upgraded to a Pix firewall and configured to allow any access from inside to outside and we started having the same problem. If you open Internet explorer 5 times in a row, the first couple may load the site almost instantly, then the third time it may take a couple of seconds and usually one out of those five times it will completely time out and give a page cannot be displayed. Usually hitting the refresh button will cause the page to load almost instantly again. Am I missing something very obvious here?

[lgijssel]

You might. Please check speed & duplex settings on the pix in- and outside interfaces.

Regards,

Leo

[stampro22]

I believe it was set to "Auto".

[p-dolbow]

There are quite a few things you should check here. First of all it seems that you are having basically the same problem with the PIX as you had with the Linksys box. I doubt that it is DNS, as the DNS lookups should be cached - especially if they are done back to back and the first couple worked.

Troubleshooting questions:

Does this occur on more than one workstation?

What model PIX do you have?

What (if any) routers are on the network?

What does you network design look like?

Please check:

Client proxy settings

Client IP settings i.e. gateway, subnet mask

Interface errors on the PIX

Interface errors on the T1/serial interfaces

MTU settings on the network devices

[stampro22]

I believe that problem may have been fixed. The firewall logs indicated a large amount of UDP outbound traffic. After much configuration fruitlessness in stopping this from the firewall side, I did a little research and found that this is most frequently caused by tracking cookies on the individual workstations. Panda protects against adware/spyware but not cookies... so I ran an Ad-aware scan on all systems and removed between 50 - 150 cookies from each. Unexplained UDP traffic stopped and Firewall memory level dropped from 15MB out of 16MB to about 10MB.

I believe what was happening before was that the firewall was running out of memory. As long as enough memory was available to handle a request, pages, and e-mail loaded quickly as they should. During high traffic times along with the very large amount of UDP traffic, it was running out of memory causing requests to be delayed until enough memory was free to handle the request.... resulting in occasional long wait times, and time outs.

How much memory use is normal? I'm a little concerned that with almost not traffic the memory indicated that 10-11MB was used.