Dear Experts;
I have updated the IOS for the PIX firewall from ver 6.3 (3) to 6.3 (5), after updating all the outbound connection was teared down from the outside interface, it was working fine before updating.
I have faced the same problem when I updated the internal firewall, but it was easy to solve by adding a static statement.
But for the external firewall, I could not solve it.
I have enabled the debug logging and the log is for example:
%PIX-6-302013: Built outbound TCP connection 563 for outside:193.109.81.33/3101
(193.109.81.33/3101) to inside:10.10.10.22/1829 (86.86.86.130/1829)
then:
%PIX-6-302014: Teardown TCP connection 563 for outside:193.109.81.33/3101
to inside:10.10.10.22/1829 duration 0:02:01 bytes 0 SYN Timeout
Kindly help me.
Many Thnaks in advance.
EXTERNAL FIREWALL:
PIX Version 6.3(5)
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 100full
interface ethernet3 100full
interface ethernet4 100full
interface ethernet5 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
nameif ethernet3 failover security10
nameif ethernet4 DMZ2 security20
nameif ethernet5 intf5 security10
enable password QLFEGyT encrypted
passwd c8ljWyg encrypted
hostname External
domain-name .local
clock timezone GST 9
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
no fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 86.86.86.232 smtpserver
object-group service webaccess tcp
port-object eq www
port-object eq https
object-group service mailaccess tcp
description Exchange Server Access from outside
port-object eq pop3
port-object eq https
port-object eq smtp
object-group service pay tcp
port-object eq 2443
port-object eq 2080
object-group network appservers
network-object host 86.86.86.222
network-object host 86.86.86.211
object-group network comtrust
network-object host 86.86.86.86
access-list outside_access_in permit tcp any host smtpserver eq smtp
access-list outside_access_in permit tcp any host 86.86.86.233 eq https
access-list outside_access_in permit tcp any host 86.86.86.234 object-group we
baccess
access-list outside_access_in permit tcp any host 86.86.86.235 object-group we
baccess
access-list outside_access_in permit tcp any host 86.86.86.233 eq www
access-list outside_access_in permit tcp any host 86.86.86.241 eq www
access-list outside_access_in permit tcp any host 86.86.86.241 eq https
access-list outside_access_in permit tcp any host 86.86.86.241 object-group webaccess
access-list outside_access_in permit tcp any host 86.86.86.248 eq www
access-list outside_access_in permit tcp any host 86.86.86.248 eq https
access-list outside_access_in permit tcp object-group comtrust object-group appservers object-group pay
access-list outside_access_in permit tcp any host 86.86.86.243 eq www
access-list outside_access_in permit tcp any host 86.86.86.233
access-list outside_access_in permit tcp any host 86.86.86.249 eq www
access-list outside_access_in permit tcp any host 86.86.86.251 eq www
access-list outside_access_in permit tcp any host 86.86.86.251 eq https
access-list dmz_access_in permit tcp host 10.12.12.12 host 10.10.10.12 eq smtp
access-list dmz_access_in permit tcp host 10.12.12.12 host 10.10.10.16 eq smtp
access-list dmz_access_in permit ip 10.12.12.0 255.255.255.0 any
access-list inside_access_in remark Outbound Rule
access-list inside_access_in permit ip 10.10.10.0 255.255.255.0 any
access-list inside_access_in remark Outbound
access-list inside_access_in permit ip 173.20.2.0 255.255.255.0 any
access-list inside_access_in permit tcp host 193.109.81.33 host 86.86.86.130 eq 3101
access-list inside_access_in permit tcp host 86.86.86.53 host 86.86.86.123 eq smtp
access-list inside_access_in permit ip 172.27.30.0 255.255.255.0 any
access-list DMZ2_access_in permit ip any any
pager lines 24
logging on
logging trap warnings
logging host inside 173.20.2.53
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu failover 1500
mtu DMZ2 1500
mtu intf5 1500
ip address outside 86.86.86.228 255.255.255.224
ip address inside 10.10.10.1 255.255.255.0
ip address dmz 10.12.12.1 255.255.255.0
ip address failover 192.168.10.1 255.255.255.0
ip address DMZ2 192.168.20.1 255.255.255.0
no ip address intf5
ip audit info action alarm
ip audit attack action alarm
failover
failover timeout 0:00:00
failover poll 3
failover replication http
failover ip address outside 86.86.86.230
failover ip address inside 10.10.10.2
failover ip address dmz 10.12.12.2
failover ip address failover 192.168.10.2
failover ip address DMZ2 192.168.20.2
no failover ip address intf5
failover link failover
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 10 86.86.86.239
global (DMZ2) 1 interface
nat (inside) 10 10.10.10.0 255.255.255.0 0 0
nat (dmz) 10 10.12.12.0 255.255.255.0 0 0
nat (DMZ2) 1 192.168.20.0 255.255.255.0 0 0
static (inside,outside) 86.86.86.233 10.10.10.12 netmask 255.255.255.255 0 0
static (inside,outside) 86.86.86.235 173.20.2.13 netmask 255.255.255.255 0 0
static (inside,outside) 86.86.86.234 10.10.10.13 netmask 255.255.255.255 0 0
static (dmz,outside) smtpserver 10.12.12.12 netmask 255.255.255.255 0 0
static (inside,outside) 86.86.86.243 173.20.2.40 netmask 255.255.255.255 0 0
static (inside,outside) 86.86.86.245 173.20.2.46 netmask 255.255.255.255 0 0
static (dmz,outside) 86.86.86.241 10.12.12.14 netmask 255.255.255.255 0 0
static (inside,dmz) 10.10.10.0 10.10.10.0 netmask 255.255.255.0 0 0
static (inside,dmz) 173.20.2.0 173.20.2.0 netmask 255.255.255.0 0 0
static (inside,outside) 86.86.86.236 173.20.2.18 netmask 255.255.255.255 0 0
static (inside,outside) 86.86.86.250 10.10.10.22 netmask 255.255.255.255 0 0
static (inside,outside) 86.86.86.251 173.20.2.17 netmask 255.255.255.255 0 0
static (inside,outside) 86.86.86.237 173.20.2.19 netmask 255.255.255.255 0 0
static (inside,outside) 86.86.86.249 173.20.2.69 netmask 255.255.255.255 0 0
static (dmz,outside) 86.86.86.248 10.12.12.170 netmask 255.255.255.255 0 0
static (inside,DMZ2) 192.168.20.30 10.10.10.16 netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group dmz_access_in in interface dmz
access-group DMZ2_access_in in interface DMZ2
route outside 0.0.0.0 0.0.0.0 86.86.86.227 1
route inside 173.20.2.0 255.255.255.0 10.10.10.10 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.10.10.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 3600
dhcpd ping_timeout 750
terminal width 80
Cryptochecksum:5168e08
Start Free Trial
