Access to Internet sites via ASA

[North323]

strange problem, upgraded code to 8.x about 3 weeks ago and now users say they can not get to some websites. they get to google, and yahoo but not

http://www.caao.org

or

http://whitepages.anywho.com

any ideas?

North

 

[unclerico]

is it consistent or just intermitent??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[North323]

its consistent...

 

[baddos]

Are you using websense or similar filtering services? I ran into a problem where there was a url length limit a while back.

 

[North323]

yes it is websense. there is a url length limit in websense? what was the fix?

 

[baddos]

Make sure you have this in your PIX/ASA's config.

url-block url-size 4

 

[North323]

the network that is having the problem is a remote office that connects to us via ASA and goes out the same internet PIX. i do not experience this issue. we both go out the same internet and use the same websense server but this is only affecting the remote office

 

[baddos]

How do you enforce the filtering? Just on the one PIX, or on the remote router and the PIX? If it's on the remote router as well, there could be a delay causing timeouts and the router has allow-mode off.

 

[North323]

filtering is done through one pix. i do not have the problem, only the remote office is having the issue

 

[North323]

any other input on this?

 

[baddos]

How are your remote offices connected? IPSEC vpn, MPLS, etc

Test a couple things at the remote office. Test pinging the websense server from the clients to be sure they can reach it. Test dns lookups using nslookup.

 

[North323]

remote office is connected via OPTEman which is basically mpls. pings work and websense works (i can get to google) also did some nslookups with no issue

 

[North323]

very strange, we have two remote offices and one does not have this issue. i did notice on the office having a problem, there is a domain name and dns info in the ASA. these remote offices tunnel back to main office and go out the main office internet...any thoughts?

 

[baddos]

On which side of the ASA is the WAN connection hooked up to?

It could be something the ASA is blocking.

 

[North323]

on which side? i dont understand the question. the WAN is on the 'outside'

 

[North323]

i found out the issue... the internet interface was 64.x.x.x 255.0.0.0 and all the websites in the 64.x.x.x network were being seen as spoofed packets. changed the subnet to what it should have been ( i did not implement this ) and all those websites magically came up