pix 515 blocks access to certain sites (only w/ linux)

[daytooner]

The problem, in a nutshell:

I have a LAN with several linux boxes (Fedora 17, both 32 and 64 bits), as well a a WInXP box. All of these are connected to the same switch, which is connected to the inside port of my PIX 515.

For a few sites (mozilla.org happens to be one of them), for http access, the tcp connection is established, but the "GET" request - or anything else for that matter - will not go through the PIX (from inside to wan). I have verified this by first, using wireshark to watch the packets being sent out from the client box, then by using the trace function in the PIX to see that the packets ARE arriving at the inside interface, but ARE NOT sent out of the wan interface.

This is for the linux boxes ONLY. When I do the same thing with my WinXP box, all works: in the PIX trace, I see the packets arrive at the inside interface, and leave the wan interace. And access to these sites are okay.

(What's a bit weird, although somewhat expected, when I connect my android phone to my LAN via WiFi, it too is unable to reach those sites - but then again, android is linux, right?)

In addition to the tracing, I have narrowed this problem down by connecting a linux box directly to my DSL router, then replacing the PIX with a simple router/gateway. Both of those solutions work.

Some background:

I have been using this PIX for about 10 years now, with the same configuration (except IP addresses). Only in the last several months has this problem started to show up.

I got this pix from a dead company at a really great price (free ), so I'd like to keep it, and not have to spend money on something else. I don't have any support license, and have not been able to get any software upgrades. Here is its version info:

taz(config)# sho ver

Cisco PIX Firewall Version 6.2(2)
Cisco PIX Device Manager Version 2.0(2)

Compiled on Fri 07-Jun-02 17:49 by morlee

taz up 1 day 8 hours

Hardware: PIX-515, 64 MB RAM, CPU Pentium 200 MHz
Flash i28F640J5 @ 0x300, 16MB
BIOS Flash AT29C257 @ 0xfffd8000, 32KB

0: ethernet0: address is 0005.3290.06d2, irq 11
1: ethernet1: address is 0005.3290.06d3, irq 10
2: ethernet2: address is 0002.b3d5.2fea, irq 9
3: ethernet3: address is 00d0.b792.2fc5, irq 7
Licensed Features:
Failover: Enabled
VPN-DES: Enabled
VPN-3DES: Enabled
Maximum Interfaces: 6
Cut-through Proxy: Enabled
Guards: Enabled
URL-filtering: Enabled
Inside Hosts: Unlimited
Throughput: Unlimited
IKE peers: Unlimited

Serial Number: 405200362 (0x1826ddea)
Running Activation Key: 0x38ac31f3 0x0630df47 0x9a77b805 0x8bc39a60

I can provide the full configuration if desired, as well as trace outputs.

Please, anyone with any idea of what's going on, PLEASE help. This is driving me nucking futs.

TIA
ken

PS: Since this PIX is at its end of life, I was wondering if any of the software upgrades would be now available without a license?

 

[iggsterman]

Are linux and windows boxes on the same subnet?
Static or DHCP on the inside? If static are default gateways set?
Have you enabled debug logging to the buffer/syslog, if so can you see anything specific to the issue?
Network diagram, full pix config, inside numbering would help.

Regarding upgrades - I do not think they will allow to download any. Cisco has become very strict about those.
I just checked, the last available release for 515 is 8.0.4.28 and they require "additional entitlement". I'd talk to a Cisco partner, or if you know a CCIE that would help