Occasional problems in sending TCP/5000 traffic over IPSec tunnel

[baskervi]

I've been battling an intermittent LAN-to-LAN VPN problem between two PIX-525's. A financial system at one location uses TCP/5000 for communications. Traffic usually flows from the remote network over the VPN tunnel to the financial system just fine. On occasion seemingly all traffic EXCEPT to TCP/5000 appears to flow fine across the tunnel. The financial system may have this port inaccessible for a few hours to a few days, and it eventually starts working again for some unknown reason. When I do a port scan across the tunnel to the financial system, all port except TCP/5000 show up. This port is also used for uPnP, but I don't see a relationship given that the packets are destined for a specific host.

Thanks for any ideas.

[umedryk]

I can think of one issue that could be causing the problem. Is there a redundant path between the two end points of the tunnel ? If this is the case, it would have not been properly configured for the tunnel for the return trafffic when the primary link is down. My two cents...

[baskervi]

One thing I didn't add to the initial post is that I turned on a sniffer at the remote end, and the packets destined for TCP/5000 don't make it to the destination. But again, all other traffic does. I haven't put a sniffer just inside the PIX internal interface on the source end, which is probably a good thing to try next. Thanks for the response.

[jackko]

when you mentioned all other traffic does work, do you mean the same server as well or the rest of the lan?

if all traffic does work on the same server except tcp5000, just wondering if the local user can get to it or not. maybe the service is not running on the server.

[baskervi]

Yes, only TCP/5000 stops working. All other sites (locally and remote) can reach this port with the exception of this one site.

[jackko]

may use the command "capture" to further understand how the traffic being sent and received. all you need to do is to create an acl (i.e. tcp 5000) and apply it to an interface.