Problem with XLATE (May be)Or TCP Conn

[Liaquat]

Hello Everyone,
We have a web server that sits in DMZ.Its configured with a static:
static (Dmz,outside)X.X.X.X 192.168.15.7 0 0
Recently we started getting calls for Web site being down every two
or three days.For troubleshooting I used the clear Xlate global
X.X.X.X command and the page was back up.
My question is that we haven't added anything in th DMZ nor that we
have changed anything except for the fact that web site was updated.
What can I do to troubleshoot and resolve the problem.What could be
causing this...We are using 6.2(2)on a 525.
Q2:Clear Xlate only clears the Translations right or more?How about
TCP connections?

regards,

Liaquat

 

[dopehead]

As far as i can remember both connections and xlats are cleared, since you can't have a connection with an xlate, so if the xlate is cleared so must the connection be.

Maybe your webserver is not up-to-date performance wise ? can you access the webserver from the inside when these customer call and say it is down from their point of view ?

Jan

Network Systems Engineer
CCNA/CQS/CCSP

 

[illyas]

Most probably your problem is due to the number of connections reached to the maximum. This is why when you clear the connnections/xlate things are getting back to normal. Pls check the static command for the web server to see whether there is any maximum connections or embryonic value is mentioned. If it is there increase it to higher number. It may be looking like this..

static (inside,outside) x.x.x.x y.y.y.y w z

where w and z are the maximum conn & embroynic value.

regrds
illyas

BS,CNE,MCSE,CCNA,SCSA

 

[Liaquat]

There is no maximum conn value or the embroynic value.They are both set to 0 0.Is it possible when my inside addresses go for this one specific web server in DMZ they dont actually get translated.That will solve the problem but I am not sure on how to actually exclude a transalation for one address in DMZ coming from Inside.

Thanks so much for your help!I have actually called this into Cisco but so far no luck.

Liaquat

 

[dopehead]

Yes, your inside traffic is not using that static, it is only usable from the outside interface. if you could post your entire config (excl. passwords and other vital official ips of course) we could be more helpful.

Also do a "show conn" when this thing occurs, if there is way to many connections, do a "show conn count" and see if you think that the number of conns are way to high for the pix.

Jan

Network Systems Engineer
CCNA/CQS/CCSP