PIX 501 slow web browsing

[Astros]

I just installed a PIX 501, not many modifications made to out of the box config at all, just some port forwarding for inbound traffic. I noticed that web browsing seems to drag much more than it did before when using a Linksys dsl router as the firewall. My first guess is that the core switch the firewall is plugged into is a Linksys 24 port unmanaged switch. I noticed the the inside interface of the pix is hard coated at 100full and thought the link to the autonegotiate ports on the switch might be causing the latency. When trying to configure the inside interface to auto, the pix would not let me. Does anyone have any ideas for a workaround for the 501 or any ideas if this is truly even the problem for the latency on the web browsing?

Sorry to be so long winded, but trying to provide some detail.

Thanks.

 

[boymarty24]

If you do a show interface what do you get?

If you ping or ftp is it slow? The slow www, is it all the time or when you do a dns lookup?

Marty

 

[Astros]

It seems to be when DNS lookups occur.

 

[boymarty24]

If you on one of your clients assign a different dnsserver, is it faster then?

Is the pix a dhcpserver or do you have a internal server handling that ( maybe win2003? )

Last question, do you have a internal dns?

 

[Astros]

I have a Win2003 server handling both DHCP and DNS for all clients. The pix is not running any dhcp functions. Haven't tried an external DNS server yet.

 

[boymarty24]

You could try to set the fixup protocol for dns to a higher value ( extensive dns on win2003 )

fixup protocol dns maximum-length 1544 ( dont remember he exact value )

The dnsserver is only internal right? Try a ipconfig/flushdns on the clients.
Dont think the problem is pix related.

 

[Astros]

Yes, DNS is only internal. I'll try it out. Thanks.

 

[adarmus]

Hi Astros, I have what seems to be an identical problem (with identical setup). Have you sorted yours out yet? If so, how?

Ta, Adam

 

[Astros]

Unfortunately not yet, I have removed the PIX and am going to set it up at my house this weekend to see if acts the same way on my DSL line there. I will let post if I can resolve anything.

 

[AgentK]

Astro, can you post the config?
so we can see what's wrong.

if it is dns related, use ip # instead of url for now, if it is faster.

go to dslreports.com/tools or other speed test sites, to test the speed of your internet connection. May sure your isp not ripping your off for what you paying.