I have to seperate networks both running pix both configured the same except for the static IP's obviously. The one works great just the way it's suppose to no problems the other is 515UR with the following configuration, the problem is when inside users try to connect to the e-mail serve in the DMZ it's very slow any files over 50k it crawls anything over 100k outlook times out after 1 minute, I have no trouble viewing downloading e-mails from the web interface just pop3, have not tried imap yet. Any suggestion are welcome thanks.
PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
hostname firewall
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name x.x.x.x mailoutside
name 192.168.x.x mail
access-list 101 permit ip 172.16.x.x 255.255.240.0 10.x.x.x 255.255.255.0
access-list smtp permit tcp any host mailoutside eq smtp
pager lines 24
interface ethernet0 10full
interface ethernet1 100full
interface ethernet2 10full
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside x.x.x.x 255.255.255.248
ip address inside 172.16.x.x 255.255.240.0
ip address dmz 192.168.x.x 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
.
.
.
global (outside) 1 interface
global (dmz) 1 192.168.x.x-192.168.x.x
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 192.168.x.x 255.255.255.0 0 0
static (dmz,outside) mailoutside mail netmask 255.255.255.255 0 0
access-group smtp in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
.
.
.
.
telnet timeout 5
ssh timeout 5
terminal width 80
PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
hostname firewall
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name x.x.x.x mailoutside
name 192.168.x.x mail
access-list 101 permit ip 172.16.x.x 255.255.240.0 10.x.x.x 255.255.255.0
access-list smtp permit tcp any host mailoutside eq smtp
pager lines 24
interface ethernet0 10full
interface ethernet1 100full
interface ethernet2 10full
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside x.x.x.x 255.255.255.248
ip address inside 172.16.x.x 255.255.240.0
ip address dmz 192.168.x.x 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
.
.
.
global (outside) 1 interface
global (dmz) 1 192.168.x.x-192.168.x.x
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 192.168.x.x 255.255.255.0 0 0
static (dmz,outside) mailoutside mail netmask 255.255.255.255 0 0
access-group smtp in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
.
.
.
.
telnet timeout 5
ssh timeout 5
terminal width 80