Pix net connection died

[GuySmiley]

Hi,

I just installed a new Pix 515e in our office over the weekend. This is the first time I've used a Pix, but I do have a few years experience with Cisco routers. Today, one of the users in my NAT pool wasn't able to connect to the internet roughly halfway through the day. Giving him a new address out of a different DHCP pool seemed to do the trick and fixed his problem. However, I'm concerned about why he lost it in the first place. I know on Cisco routers you can specify the timeout lengths for NAT sessions and I'm wondering if this might be a possible culprit on the Pix. I just haven't been able to find the command to look at this, though. Any suggestions?

Also, the Pix just lost its net connection entirely. I was logged into it using the PDM and had just enabled debug level logging to my syslog server (still not working for some reason) and all interfaces on the Pix stopped responding. I had to do a reload from the console in order to get a connection again. Any ideas what might be causing these issues?

 

[themut]

How are your NAT and global statements configured? It could be you had run out of IP addresses in your pool. Are you using a PAT address?

Regarding the other issue... without syslogs it is hard to guess.

 

[GuySmiley]

Here's a copy of my running config if that helps:

Building configuration...
: Saved
:
PIX Version 6.3(1)
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 DMZ security4
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
no fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
names
name 10.0.0.2 mail-relay
name 172.16.0.200 Exchange
name 172.16.0.250 Netscreen
name 192.168.2.0 DataCenter
name 172.16.0.175 Icarus
name 172.16.0.161 TheFuture
name 172.16.0.159 Whitestar
name 172.16.0.165 Parish
name 172.16.0.162 Winterboy
name 172.16.0.160 ChrisC
object-group service OfficeTraffic tcp
port-object eq ftp
port-object eq ftp-data
port-object eq domain
port-object eq aol
port-object eq www
port-object eq telnet
port-object eq https
port-object eq smtp
object-group service POPMail tcp
port-object eq 1187
object-group service TermSvc tcp
port-object eq 3389
object-group service PoPRestrict tcp
port-object eq pop3
object-group service Site-Shared tcp
port-object eq https
port-object eq www
access-list inside_access_in permit ip any any
access-list DMZ_access_in permit tcp host mail-relay host Exchange eq smtp
access-list DMZ_access_in permit ip host mail-relay any
access-list outside_access_in permit tcp any host relay-outside eq smtp
access-list outside_access_in permit tcp any host 192.12.x.x eq www
access-list outside_access_in permit tcp any host 192.12..x.x object-group POPMail
access-list outside_access_in permit tcp any host 192.12.x.x object-group TermSvc
access-list outside_access_in permit tcp any host 192.12.x.x object-group TermSvc
access-list outside_access_in permit tcp any host 192.12.x.x object-group TermSvc
access-list outside_access_in permit tcp any host 192.12.x.x object-group TermSvc
access-list outside_access_in permit tcp any host 192.12.x.x object-group Site-Shared
access-list outside_access_in permit tcp any host 192.12.x.x object-group Site-Shared
access-list outside_access_in permit tcp any host 192.12.x.x object-group Site-Shared
access-list outside_access_in permit tcp any host 192.12.x.x object-group Site-Shared
access-list outside_access_in permit tcp any host 192.12.x.x object-group Site-Shared
access-list outside_access_in permit tcp any host relay-outside object-group TermSvc
access-list outside_access_in permit tcp any host 192.12.x.x object-group TermSvc
pager lines 24
logging on
logging timestamp
logging trap notifications
logging host inside 172.16.0.4 6/1470
mtu outside 1500
mtu inside 1500
mtu DMZ 1500
ip address outside 192.12.x.x 255.255.255.0
ip address inside 172.16.0.1 255.255.0.0
ip address DMZ 10.0.0.1 255.0.0.0
ip audit info action alarm
ip audit attack action alarm
pdm location 172.16.0.4 255.255.255.255 inside
pdm location 172.16.1.0 255.255.255.0 inside
pdm location mail-relay 255.255.255.255 DMZ
pdm location relay-outside 255.255.255.255 outside
pdm location Exchange 255.255.255.255 inside
pdm location Netscreen 255.255.255.255 inside
pdm location DataCenter 255.255.255.0 inside
pdm location Whitestar 255.255.255.255 inside
pdm location Icarus 255.255.255.255 inside
pdm location TheFuture 255.255.255.255 inside
pdm location Parish 255.255.255.255 inside
pdm location Winterboy 255.255.255.255 inside
pdm location 172.16.0.180 255.255.255.255 inside
pdm location 172.16.0.181 255.255.255.255 inside
pdm location 172.16.0.183 255.255.255.255 inside
pdm location 172.16.0.184 255.255.255.255 inside
pdm location ChrisC 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 192.12.x.x
nat (inside) 1 172.16.1.0 255.255.255.0 0 0
nat (inside) 1 172.16.0.0 255.255.0.0 dns 0 0
static (DMZ,outside) relay-outside mail-relay netmask 255.255.255.255 0 0
static (inside,DMZ) Exchange Exchange netmask 255.255.255.255 0 0
static (inside,outside) 192.12.x.x Exchange netmask 255.255.255.255 0 0
static (inside,outside) 192.12.x.x Whitestar netmask 255.255.255.255 0 0
static (inside,outside) 192.12.x.x Icarus netmask 255.255.255.255 0 0
static (inside,outside) 192.12.x.x TheFuture netmask 255.255.255.255 0 0
static (inside,outside) 192.12.x.x Parish netmask 255.255.255.255 0 0
static (inside,outside) 192.12.x.x 172.16.0.180 netmask 255.255.255.255 0 0
static (inside,outside) 192.12.x.x 172.16.0.181 netmask 255.255.255.255 0 0
static (inside,outside) 192.12.x.x 172.16.0.183 netmask 255.255.255.255 0 0
static (inside,outside) 192.12.x.x 172.16.0.184 netmask 255.255.255.255 0 0
static (inside,outside) 192.12.x.x ChrisC netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group DMZ_access_in in interface DMZ
route outside 0.0.0.0 0.0.0.0 192.12.x.1 1
route inside DataCenter 255.255.255.0 172.16.0.251 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
ntp server 192.5.41.41 source outside
ntp server 192.5.41.40 source outside prefer
http server enable
http 172.16.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
isakmp enable outside
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
telnet 172.16.0.0 255.255.0.0 inside
telnet timeout 5
ssh 172.16.0.0 255.255.0.0 inside
ssh timeout 5
console timeout 0
dhcpd address 172.16.1.2-172.16.1.252 inside
dhcpd dns 172.16.0.153 172.16.0.154
dhcpd lease 43200
dhcpd ping_timeout 750
dhcpd domain quitnet.com
dhcpd enable inside
terminal width 80

 

[GuySmiley]

Also, I've only got maybe 10 or so users in the office behind this firewall. Albeit, they are all configured to go through the one address in the pool.

 

[dx1]

>logging host inside 172.16.0.4 6/1470

Looks like your doing tcp syslogging. Was the syslog server offline or is the HD full?

Everything else looks fine.

 

[GuySmiley]

Yes, I am doing TCP syslogging, and the machine is online and connected to the Pix. There's plenty of HD space, so that shouldn't be an issue. Either way, the Pix crashed again around 7:00am this morning, so I have to step things up a bit to find a resolution.

 

[GuySmiley]

OK - I finally got the syslog to work on a different host. Something must have gotten botched in the install on the first host. Now I just need to keep an eye on the syslogs to see if there are any warnings or alerts for an impending hang...