Hello, I think I have run into a massive bug with IOS 15.
I've been trying to get a 1941 (SEC-K9) router that has a 4-port EHWIC-4ESG-P module configured for a few days now.
I have everything working as planned - SMTP, IMAP, DNS are all fine from the outside to the internal DMZ hosts - with the exception of serving traffic from the outside to an internal DMZ HTTP web server. NAT is setup statically -- I can establish a connection from outside the network to the internal server on TCP 80, the HTTP GET is sent, and the web server DOES try and send the return traffic (I have verified this with tcpdump on the web server itself) .. BUT, the router does not forward this return traffic back to the remote client.
Equally strange, with some of the web pages that have only a few lines of HTML, the router will pass the HTML back to the client but NOT any of the images. In fact, when the remote clients attempt to hit http://site.tld/some_image.jpg .. the connection opens, but just hangs.
One other thing to mention, I CAN complete HTTP requests from the LAN > DMZ web server, and the pages load correctly as they should.
I'm totally at a loss, I had a CCNP briefly looks at the problem, and all he said was he'd never seen this behavior before and thought it might be a bug.
Really strange.. here are the relevant bits in my config:
version 15.2
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime localtime
service password-encryption
service sequence-numbers
!
hostname rtr
!
boot-start-marker
boot system flash0 c1900-universalk9-mz.SPA.152-2.T.bin
boot-end-marker
!
!
security authentication failure rate 10 log
security passwords min-length 6
logging userinfo
logging buffered 51200 warnings
no logging console
no logging monitor
!
!
clock timezone Pacific -8 0
!
no ipv6 cef
no ip source-route
no ip gratuitous-arps
ip auth-proxy max-login-attempts 5
ip admission max-login-attempts 5
no ip domain lookup
ip name-server 4.2.2.2
ip port-map user-submission port tcp 587
ip port-map user-rsync port tcp 873
ip port-map user-apc port tcp 3551
ip port-map user-smtps port tcp 465
ip port-map user-imaps port tcp 44993
ip inspect log drop-pkt
ip inspect audit-trail
ip inspect udp idle-time 1800
ip inspect dns-timeout 7
ip inspect tcp idle-time 14400
no ip cef
!
multilink bundle-name authenticated
!
parameter-map type inspect global
log dropped-packets enable
no ip ftp passive
ip scp server enable
!
class-map type inspect match-any all-traffic-cm
match protocol http
match protocol https
match protocol user-rsync
match protocol user-smtps
match protocol user-submission
match protocol ftp
match protocol dns
match protocol ntp
match protocol ssh
match protocol tcp
match protocol udp
match protocol icmp
class-map type inspect match-any dmz-protocols-cm
match protocol http
match protocol smtp
match protocol user-smtps
match protocol user-submission
match protocol user-imaps
match protocol dns
match protocol tcp
class-map type inspect match-all out-dmz-cm
match class-map dmz-protocols-cm
match access-group name out-dmz-acl
class-map type inspect match-all permit-all-cm
match access-group name permit-all-acl
match class-map all-traffic-cm
!
policy-map type inspect out-dmz-pm
class type inspect out-dmz-cm
inspect
class class-default
drop log
policy-map type inspect permit-all-pm
class type inspect permit-all-cm
inspect
class class-default
drop log
!
zone security DMZ
zone security OUT
zone-pair security OUT_to_DMZ source OUT destination DMZ
service-policy type inspect out-dmz-pm
zone-pair security DMZ_to_OUT source DMZ destination OUT
service-policy type inspect permit-all-pm
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description $ETH-WAN$
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
zone-member security OUT
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no mop enabled
!
interface GigabitEthernet0/1
description $ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$$ETH-LAN$
ip address 10.10.10.1 255.255.255.248
ip access-group 100 in
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
speed auto
no mop enabled
!
interface GigabitEthernet0/0/0
description LAN
switchport access vlan 2
switchport trunk native vlan 2
no ip address
no mop enabled
!
interface GigabitEthernet0/0/1
description DMZ
switchport access vlan 3
switchport trunk native vlan 3
no ip address
no mop enabled
!
interface GigabitEthernet0/0/2
no ip address
shutdown
!
interface GigabitEthernet0/0/3
no ip address
shutdown
!
interface Vlan1
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no mop enabled
!
interface Vlan2
ip address 172.16.1.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly in
zone-member security LAN
ip tcp adjust-mss 1412
no mop enabled
!
interface Vlan3
ip address 172.16.98.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly in
zone-member security DMZ
no mop enabled
!
interface Vlan4
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly in
shutdown
no mop enabled
!
interface Dialer1
ip address X.X.X.28 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip flow ingress
ip flow egress
ip nat outside
ip virtual-reassembly in
zone-member security OUT
encapsulation ppp
dialer pool 1
ppp ..snip..
!
ip forward-protocol nd
!
no ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip flow-top-talkers
top 100
sort-by bytes
!
ip nat inside source list DMZ interface Dialer1 overload
ip nat inside source static tcp 172.16.98.4 25 X.X.X.23 25 extendable
ip nat inside source static tcp 172.16.98.4 53 X.X.X.23 53 extendable
ip nat inside source static udp 172.16.98.4 53 X.X.X.23 53 extendable
ip nat inside source static tcp 172.16.98.5 80 X.X.X.23 80 extendable
ip nat inside source static tcp 172.16.98.4 465 X.X.X.23 465 extendable
ip nat inside source static tcp 172.16.98.4 587 X.X.X.23 587 extendable
ip nat inside source static tcp 172.16.98.4 993 X.X.X.23 993 extendable
ip nat inside source static tcp 172.16.98.4 993 X.X.X.23 44993 extendable
ip nat inside source static tcp 172.16.98.11 25 X.X.X.24 25 extendable
ip nat inside source static 172.16.98.11 X.X.X.24
ip nat inside source static tcp 172.16.98.4 53 X.X.X.25 53 extendable
ip nat inside source static udp 172.16.98.4 53 X.X.X.25 53 extendable
ip nat inside source static tcp 172.16.98.5 80 X.X.X.25 80 extendable
ip nat inside source static tcp 172.16.98.4 53 X.X.X.27 53 extendable
ip nat inside source static udp 172.16.98.4 53 X.X.X.27 53 extendable
ip nat inside source static tcp 172.16.98.5 80 X.X.X.27 80 extendable
!
ip access-list standard DMZ
permit 172.16.98.0 0.0.0.255
!
ip access-list extended out-dmz-acl
permit tcp any host 172.16.98.4 eq smtp
permit tcp any host 172.16.98.4 eq domain
permit udp any host 172.16.98.4 eq domain
permit tcp any host 172.16.98.5 eq www
permit tcp any host 172.16.98.11 eq smtp
permit tcp any host 172.16.98.4 eq 465
permit tcp any host 172.16.98.4 eq 587
permit tcp any host 172.16.98.4 eq 36124
permit tcp any host 172.16.98.11 eq 5223
ip access-list extended permit-all-acl
permit ip any any
!
no cdp run
!
!
!
!
control-plane
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
transport output none
line aux 0
exec-timeout 0 0
transport output none
line 2
exec-timeout 0 0
no activation-character
no exec
transport preferred none
transport input all
transport output none
stopbits 1
line vty 0 4
access-class 23 in
privilege level 15
logging synchronous
transport input ssh
transport output ssh
line vty 5 15
access-class 23 in
privilege level 15
logging synchronous
login authentication local_auth
transport input ssh
transport output ssh
!
scheduler allocate 20000 1000
!
end
