PIX 501 Xlate issues.

[MarkUU]

I have a PIX 501 with a few web sites behind it. I am using Static and conduits to get through. These sites are not getting that much traffic, but for some reason I have to go up and run CLEAR XLATE every so often becasue the PIX stops allowing traffic to go through. I have the timeouts set to a low increment. All suggetions are greatly appreciated.

 

[netwrkr]

I have seen this before. Post your config and I can pinpoint exactly where the problem lies.

Tom

 

[MarkUU]

Hey netwrkr thanks alot for looking at this.

PIX Version 6.1(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname pixfirewall
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name xxx.xxx.xxx.xxx Inside
pager lines 24
interface ethernet0 10baset
interface ethernet1 10full
icmp permit any echo-reply outside
mtu outside 1500
mtu inside 1500
ip address outside xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
ip address inside Inside xxx.xxx.xxx.xxx
ip verify reverse-path interface outside
ip audit info action alarm
ip audit attack action alarm reset
pdm location Inside xxx.xxx.xxx.xxx inside
pdm location xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx inside
pdm location xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx inside
pdm location xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 xxx.xxx.xxx.xxx netmask xxx.xxx.xxx.xxx
nat (outside) 1 0.0.0.0 0.0.0.0 0 0
nat (inside) 1 xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx 0 0
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
static (inside,outside) xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx netmask 255.255.255.255 0 200
conduit permit icmp any any
conduit permit icmp host xxx.xxx.xxx.xxx any
conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq 443 any
conduit permit tcp host xxx.xxx.xxx.xxx eq smtp any
conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq 443 any
conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

conduit permit tcp host xxx.xxx.xxx.xxx eq

http://www any

route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
timeout conn 0:05:00 half-closed 0:05:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:02:00 absolute
timeout xlate 0:03:00
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx outside
http xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx inside
http xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx inside
telnet timeout 5
ssh timeout 5
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
: end

 

[yizhar]

HI.

> timeout xlate 0:03:00

I would remove this line or set a very high timeout, since you are using static so there is no reason to timeout the translations:

An upgrade to version 6.2x may also help if changing the configuration does not.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar