Noticeable change in speed after PIX install

[jce001]

I installed a 506e on a network with about 100 users. I seems to work fine. The only change I had to make was reduce the Xlate timeout to 30min instead of 3hrs. After the install though my connection is really slow. Pages timeout all the time, and I hit refresh and they come up really slow. It's like I'm on a good dial-up, when I have a full blown T-1 at the head end. I'm sure it's in the config somewhere. Any help would be appreciated. Thanks.

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password SXvq7P8buC7GW0tb encrypted
passwd 7arcFHBCVf3ZofMH encrypted
hostname firewall
domain-name millstl.com
clock timezone CST -6
clock summer-time CDT recurring
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
no pager
logging timestamp
mtu outside 1500
mtu inside 1500
ip address outside 64.242.49.194 255.255.255.192
ip address inside 192.168.25.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.25.240 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 64.242.49.197-64.242.49.254 netmask 255.255.255.192
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 64.242.49.193 1
timeout xlate 0:30:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.25.240 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside 192.168.25.240 root
floodguard enable
sysopt noproxyarp inside
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
telnet 192.168.25.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.25.30-192.168.25.230 inside
dhcpd dns 198.6.1.5 204.194.10.206
dhcpd lease 432000
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80

 

[baddos]

Try running PAT instead of NAT.

no global (outside) 1 64.242.49.197-64.242.49.254 netmask 255.255.255.192
global (outside) 1 interface

This will let all 100 users use the internet at once instead of 7.

 

[yizhar]

HI.

You can monitor bandwidth usage with PDM, and with the command:
show conn

You should contact the ISP - maybe an issue at their side.

Use syslog messages at the pix to see what is going on.

> Pages timeout all the time...
What about other types of connections?
How is DNS implemented?

You should add reverse lookup PTR records in DNS for your public IP addresses - ask your ISP to do that.
Look here:

http://www.dnsstuff.com/tools/ptr.ch?ip=64.242.49.197

And here:

http://www.cisco.com/warp/public/110/21.html

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar