Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
Problems with UDP broadcast / response over Client VPN to PIXEnvironment:Win2K client with Cisco VPN version 3.6.3PIX 515-R running 6.2(2) w/ 3DESClient connects, authenticates, and is assigned IP from poolClient Win2K can Ping, use TCP (telnet, etc....
Background: PIX 525-UR running v6.2(2)being hit by high volume of fragmented udp packets (around 80+ Mbps)cpu usage overing around 88%traffic is being dropped by ruleabout 10 Mbps is legit trafficThe firewall is holding it's own but I was wond...
Using a PIX with version 6.2Terminating a tunnel using IPSEC.What is the best way to limit inbound ports?Say the far end of the tunnel is terminated on a partner firewall. I want to allow in https over the tunnel, and only https.Since the PIX uses o...
I have been upgrading the code on all our PIXs.I've been moving to 6.2 code for the added functions and the updated capability of PDM to support VPN and grouping.The bulk of the firewalls are 515s but I do have a pair of 525s currently running 6.0(1)...
They can ping the 192.0.2.1 ip just fine. You would think that an initiated UDP unicast would work if ping does and there aren't ACLs on the inside interface to stop it.
Follow-up,Looked at my graphs again. Volume is actually around 60 Mbps, not 80. So, theoretically it should be able to push more than it is. Still hovering around 85-89% on the cpu.Scot
Kurtis,But won't that just allow me to filter on udp500 and protocols 50 and 51? Since that is what they are encapsulated in when they hit the external interface. The traffic hits the outside interface as protocol 50, I have an ACL permitting IP Pr...
Thanks for the response. Sometimes it's helpful just to know the conditions that cause a bug so you can make an informed decision.I appreciate the time and detail of the response. Very helpful.I'll run with the 6.2(2) since I can control the condit...
