web access slow after deploying PIX 1

[yert33]

Access to the internet is slo

http://wwwwww

after putting a PIX 520 in last night. Here's the config. Anything jump out at you?

PIX Version 6.3(3)
interface ethernet0 10full
interface ethernet1 100full
interface ethernet2 100full
interface ethernet3 100full
interface ethernet4 auto shutdown
interface ethernet5 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz1 security40
nameif ethernet3 dmz2 security20
nameif ethernet4 dmz3 security60
nameif ethernet5 dmz4 security80
enable password encrypted
passwd encrypted
hostname LDH
domain-name stlr
no fixup protocol dns
fixup protocol ftp 21
no fixup protocol h323 h225 1720
no fixup protocol h323 ras 1718-1719
no fixup protocol http 80
no fixup protocol rsh 514
no fixup protocol rtsp 554
no fixup protocol sip 5060
no fixup protocol sip udp 5060
no fixup protocol skinny 2000
no fixup protocol smtp 25
no fixup protocol sqlnet 1521
no fixup protocol tftp 69
names
access-list compiled
access-list acl_out permit icmp any any
access-list acl_out permit tcp any host xxx.xxx.xxx.252 eq pcanywhere-data
access-list acl_out permit udp any host xxx.xxx.xxx.252 eq pcanywhere-status
access-list acl_out permit tcp any host xxx.xxx.xxx.252 eq www
access-list acl_out permit udp any host xxx.xxx.xxx.252 eq www
access-list acl_out permit tcp any host xxx.xxx.xxx.252 eq lotusnotes
access-list acl_out permit udp any host xxx.xxx.xxx.252 eq 1352
access-list acl_out permit tcp any host xxx.xxx.xxx.252 eq smtp
access-list acl_out permit tcp any host xxx.xxx.xxx.253 eq pcanywhere-data
access-list acl_out permit udp any host xxx.xxx.xxx.253 eq pcanywhere-status
access-list acl_out permit tcp any host xxx.xxx.xxx.253 eq www
access-list acl_out permit udp any host xxx.xxx.xxx.253 eq www
access-list acl_out permit tcp any host xxx.xxx.xxx.253 eq lotusnotes
access-list acl_out permit udp any host xxx.xxx.xxx.253 eq 1352
access-list acl_out permit tcp any host xxx.xxx.xxx.253 eq smtp
access-list acl_out permit tcp any host xxx.xxx.xxx.251 eq www
access-list acl_out permit udp any host xxx.xxx.xxx.251 eq www
access-list acl_out permit tcp any host xxx.xxx.xxx.251 eq pcanywhere-data
access-list acl_out permit udp any host xxx.xxx.xxx.251 eq pcanywhere-status
access-list acl_out permit tcp any host xxx.xxx.xxx.251 eq ftp
access-list acl_out permit tcp any host xxx.xxx.xxx.251 eq ftp-data
access-list acl_out permit udp any host xxx.xxx.xxx.251 eq 20
access-list acl_out permit udp any host xxx.xxx.xxx.251 eq 21
access-list acl_inside permit udp any any
access-list acl_inside permit tcp any any
access-list acl_inside permit icmp any any
access-list acl_dmz2 permit icmp any any
access-list acl_dmz2 permit tcp any any
access-list acl_dmz2 permit udp any any
access-list acl_dmz1 permit tcp any any
access-list acl_dmz1 permit udp any any
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
mtu dmz2 1500
mtu dmz3 1500
mtu dmz4 1500
ip address outside xxx.xxx.xxx.250 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip address dmz1 192.168.2.4 255.255.255.0
ip address dmz2 192.168.3.4 255.255.255.0
no ip address dmz3
no ip address dmz4
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address dmz1
no failover ip address dmz2
no failover ip address dmz3
no failover ip address dmz4
pdm history enable
arp timeout 14400
global (outside) 1 xxx.xxx.xxx.254 netmask 255.255.255.248
global (dmz1) 1 192.168.2.94 netmask 255.255.255.0
global (dmz2) 1 192.168.3.94 netmask 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz1) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz2) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) xxx.xxx.xxx.252 192.168.1.2 netmask 255.255.255.255 0 0
static (inside,outside) xxx.xxx.xxx.253 192.168.1.5 netmask 255.255.255.255 0 0
static (dmz1,outside) xxx.xxx.xxx.251 192.168.2.10 netmask 255.255.255.255 0 0
static (inside,dmz1) 192.168.2.15 192.168.1.12 netmask 255.255.255.255 0 0
access-group acl_out in interface outside
access-group acl_inside in interface inside
access-group acl_dmz1 in interface dmz1
access-group acl_dmz2 in interface dmz2
route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.249 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.1.5 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.60-192.168.1.125 inside
dhcpd dns 168.215.165.186 216.136.33.82
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable inside

 

[FestusMcShamus]

with so many acl's, you should use turbo access lists to speed things up.

 

[yert33]

Didn't I by using "access-list compiled" ?

 

[yert33]

So maybe I've figured some of it out:
About 12 machines on the inside LAN had public addresses for their Domino server (also on the inside) in their hosts file. I deleted all references to Domino servers in all hosts files and used the Notes connection document method. That seems to have solved some of the packet retransmission problems.

Then I (imagine) setup a syslog server and turned loggin on. Saw a lot of Warnings saying "Line proctocol on Interface outside, changed state to up".

I changed the outside interface from 10full to 10baseT and the warnings went away. The network efficiency seems to be going up, too.

Question: where do I find explanations for the Errors and Warnings and Critical (well all of 'em, I guess) log entried I see in the syslog server?

Thanks....

 

[baddos]

I would try using auto negotiation on your outside interface. Remember that both sides have to match, one side can't be 10Full and the other be auto, etc.

What is the outside interface plugged into (hub, switch, dsl modem)?

 

[themut]

Here's a link explaining the meaning of every syslog message:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/63syslog/pixemsgs.htm

 

[yert33]

Thanks to all:

baddos - the outside interface is connected to our Cisco 2600 router. I changed the duplex and speed of it's fastethernet interface from auto/auto to half/10 just to exactly match the outside interface of the PIX.

themut - thanks for the link.