PIX effect on local (inside network) 1

[Steve Bowman]

Strange internal network issue

Local network 10.10.3.x 255.255.255.0
clients inside the network telneting into a SCO Unix on the local network i.e.
win32:10.10.3.12 -> sco:10.10.3.14
the telnet session does a complete drop after 5 minutes
we have looked at lots of sco and internal network stuff to no solution turned on keepalives so on and so on with no luck. I then had a moment of reason and un-plugged the PIX and sure enough the sessions stayed connected inexcess of 30 minutes I plugged back in the PIX and dropped in 5.

I did not originaly look at the PIX assuming local connection no gateway no PIX but I guess I am wrong.

Looking at the PIX the only lines I suspect are

timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute

any ideas?

Steve Bowman
Independent Technology, Inc.
CA, USA

 

[voltron1011]

Show your 'fixup protocol' commands.

 

[voltron1011]

Change the telnet timeout to a higher value than 5

 

[Steve Bowman]

no fixup protocol dns
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69

I thought the telnet timeout was used for telnet into the PIX?

I have:
telnet 0.0.0.0 0.0.0.0 outside
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5

Steve Bowman
Independent Technology, Inc.
CA, USA

 

[voltron1011]

You are correct with the telnet timeout 5. That's only for telneting into the Pix.

If the users are telneting into a box INSIDE the network, why is the Pix even an issue?

 

[voltron1011]

Show your entire config.

 

[Steve Bowman]

As i said in the first part of the post I never thought of the PIX because this was local LAN traffic however as soon as I pull the PIX off the network the connection stays up and as soon as I plug it back on the connection drops in 5

there is a static inside outside configured for the unix in question and am not sure how the pix consideres this session to be under it's responsiability

here is the config

PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password encrypted
passwd encrypted
hostname pix
domain-name local.stover.com
no fixup protocol dns
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name xx.xx.xx.209 server_ext
name 10.10.3.11 server_int
name 10.10.2.0 vpn_pool
name 10.10.3.1 pix_int
name xx.xx.xx.210 pix_ext
name 10.10.3.12 Stover02
name 10.10.4.0 Tampa
access-list outside_access_in permit icmp any any
access-list outside_access_in permit tcp any host server_ext eq 3389
access-list outside_access_in permit tcp any host server_ext eq smtp
access-list outside_access_in permit tcp any host server_ext eq pop3
access-list outside_access_in permit tcp any host server_ext eq www
access-list outside_access_in permit tcp any host xx.xx.xx.211 eq 3389
access-list outside_access_in permit tcp any host xx.xx.xx.211 eq ftp-data
access-list outside_access_in permit udp any host xx.xx.xx.211 eq 20
access-list outside_access_in permit tcp any host xx.xx.xx.211 eq ftp
access-list outside_access_in permit udp any host xx.xx.xx.211 eq 21
access-list outside_access_in permit tcp any host xx.xx.xx.211 eq pcanywhere-data
access-list outside_access_in permit udp any host xx.xx.xx.211 eq 5631
access-list outside_access_in permit tcp any host xx.xx.xx.211 eq 5632
access-list outside_access_in permit udp any host xx.xx.xx.211 eq pcanywhere-status
access-list outside_access_in permit tcp any host xx.xx.xx.211 eq telnet
access-list outside_access_in permit udp any host xx.xx.xx.211 eq 23
access-list outside_access_in permit tcp any host xx.xx.xx.211 eq ssh
access-list outside_access_in permit udp any host xx.xx.xx.211 eq 22
access-list outside_access_in permit tcp any host xx.xx.xx.211 eq 8899
access-list outside_access_in permit tcp any host xx.xx.xx.212 eq telnet
access-list outside_access_in permit udp any host xx.xx.xx.212 eq 23
access-list vpn_ip_pool_splitTunnelAcl permit ip 10.10.3.0 255.255.255.0 any
access-list inside_outbound_nat0_acl permit ip any vpn_pool 255.255.255.0
access-list inside_outbound_nat0_acl permit ip 10.10.3.0 255.255.255.0 Tampa 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip any vpn_pool 255.255.255.0
access-list outside_cryptomap_dyn_20 permit ip 10.10.3.0 255.255.255.0 Tampa 255.255.255.0
access-list inside_access_in permit udp any any
access-list inside_access_in permit tcp any any
access-list inside_access_in permit icmp any any
access-list inside_access_in permit ip any any
pager lines 24
icmp permit any outside
mtu outside 1500
mtu inside 1500
ip address outside pix_ext 255.255.255.248
ip address inside pix_int 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool vpn_ip_pool 10.10.2.50-10.10.2.70
pdm location 0.0.0.0 0.0.0.0 inside
pdm location 0.0.0.0 255.255.255.255 outside
pdm location 0.0.0.0 255.255.255.255 inside
pdm location server_int 255.255.255.255 inside
pdm location vpn_pool 255.255.255.0 outside
pdm location server_ext 255.255.255.255 outside
pdm location xx.xx.xx.211 255.255.255.255 outside
pdm location Stover02 255.255.255.255 inside
pdm location 10.10.3.13 255.255.255.255 inside
pdm location xx.xx.xx.212 255.255.255.255 outside
pdm location Tampa 255.255.255.0 outside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) server_ext server_int netmask 255.255.255.255 0 0
static (outside,inside) server_int server_ext netmask 255.255.255.255 0 0
static (outside,inside) Stover02 xx.xx.xx.211 netmask 255.255.255.255 0 0
static (inside,outside) xx.xx.xx.211 Stover02 netmask 255.255.255.255 0 0
static (inside,outside) xx.xx.xx.212 10.10.3.13 netmask 255.255.255.255 0 0
static (outside,inside) 10.10.3.13 xx.xx.xx.212 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.214 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server RADIUS (inside) host server_int vpnremote2005 timeout 10
aaa-server LOCAL protocol local
http server enable
http 0.0.0.0 0.0.0.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication RADIUS
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp nat-traversal 20
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup vpnremote address-pool vpn_ip_pool
vpngroup vpnremote dns-server server_int
vpngroup vpnremote wins-server server_int
vpngroup vpnremote default-domain local.stover.com
vpngroup vpnremote split-tunnel vpn_ip_pool_splitTunnelAcl
vpngroup vpnremote split-dns local.stover.com
vpngroup vpnremote idle-time 1800
vpngroup vpnremote password ********
telnet 0.0.0.0 0.0.0.0 outside
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80


Steve Bowman
Independent Technology, Inc.
CA, USA

 

[NetworkGhost]

Unless this box physically resides outside of the pix then the Pix is not the issue. You said if you unplug the pix it works?
Is there a IP conflict going on with one of the statics from outside to inside?

What is this?

static (outside,inside) 10.10.3.13 xx.xx.xx.212 netmask 255.255.255.255 0 0

Thats not your SCO Box is it?

 

[Steve Bowman]

Yes it is!

Steve Bowman
Independent Technology, Inc.
CA, USA

 

[Steve Bowman]

I kind of see what you may be on to. This is another vendor's config and the real issue is that they are telling me that My Application is broken and not there issue (they are charged with the network) but refuse to assist with debugging all they will provide is the config
What would be the significance for the commands

static (inside,outside) xx.xx.xx.212 10.10.3.13 netmask 255.255.255.255 0 0
static (outside,inside) 10.10.3.13 xx.xx.xx.212 netmask 255.255.255.255 0 0

Myself I only ever have use the Static (inside,outside) never both

If I am understanding what I see here ARE THEY REVERSED? IE
inside,outside (local dotted net) (external dotted net) not reversed as they have it here?


Steve Bowman
Independent Technology, Inc.
CA, USA

 

[NetworkGhost]

Well if the box is indeed on your network and not natted to make it look like its on your network then that is a problem. The line in the Pix will need to go away. The reason why you are seeing this is because the Pix is proxy arping for that address and the box on the inside is also. Causing a conflict.

 

[Steve Bowman]

If I understand the Static Command it should just read 1 (one) line

Static (inside,outside) 10.10.3.13 xxx.xxx.xxx.212 netmask 255.255.255.255 0 0

and this would allow to access the inside address 10.10.3.13 by the outside address xxx.xxx.xxx.212 for any protocol allowed by the access-list from OUTSIDE the network

Steve Bowman
Independent Technology, Inc.
CA, USA

 

[NetworkGhost]

Yes that is correct

 

[Steve Bowman]

I think you may be on to something here. I was looking at timeouts and various other lines and never thought to look at the static set.

I will test this change and POST results, thank you for your time

Steve Bowman
Independent Technology, Inc.
CA, USA

 

[NetworkGhost]

Im willing to bet thats the problem.

 

[Steve Bowman]

I have not been able to test yet the vendor is dragging there feet making the change. What I did do in the meantime was Terminal Serv into the box I am using to test and sure enough arp -a on that box shows the same MAC Address for both the Internal->SCO and the Internal->PIX. And I will POST as soon as I get to test.

Steve Bowman
Independent Technology, Inc.
CA, USA

 

[NetworkGhost]

Who is your Vendor? Just curious.

 

[Steve Bowman]

A Company called IT-21. They have been all along insisting that this could not be any issue with the network and that I must not have something not right on the Unix and since I am the vendor injecting a new application onto the wire it MUST be me, even though a test 3 weeks ago showed that when the PIX was pulled the behavior changed. Took 1.5 weeks to just get a peek at the config. They have so far today ignored emails and voice mails so it could be until tomarrow until I get good test. What I did do was add a static arp on the win32 box and I am up in excess of 20. So without the test I am 99% sure this is a closed ticket. VERY GOOD JOB, I think you deserve a star if only for the effort and a big thank you to the others that responded to this post.

I will still post 100% resolution post test

Steve Bowman
Independent Technology, Inc.
CA, USA

 

[rtmags]

I had a similiar situation where after a short time applications would stop working. I could not even ping the box (even though it was on the same local network). If I pinged a client for the target computer, the application would start working again, but for a short period of time.

When I did an arp -a it showed that the ip address of the target computer and the "inside" port of the pix (which was all of the local computer's default gateway) had the same mac address.

When I looked at the config, I found that I goofed and had 2 static translations, one going inside out and another going outside in (just like you!) for the same ip address.

I bet if you do an arp -a you will see that the target computer and inside port of the pix will show the same mac address!

 

[NetworkGhost]

That was a pretty easy fix. I work for a large ISP and we get many calls a day. I would question a vendor who cant help youi with a fast response to a paid service they are providing, especially when it comes to you firewall.