Pix doesn't respond after a while
Kindy Sylla <[email protected]> Tue, 9 May 2006 10:55:56 +0200 (CEST)
| Newsgroups | gmane.comp.security.vpn |
|---|---|
| Message-ID | <[email protected]> |
--===============1404893481== Content-Type: multipart/alternative; boundary="0-1644056276-1147164956=:13201" Content-Transfer-Encoding: 7bit --0-1644056276-1147164956=:13201 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Hi, =20 I am having a strange behaviour with a Cisco PIX Firewall Version 6.3(5= ). The configuration is done , the VPN are created between the 2 differen= ts sites. The probl=E8me is after 5 to 6 hours of running, the ping to th= e remote hosts doesn't go through. When i try to ping a remote host, I se= e the followings line in the debug icmp trace:=20 =20 -request from inside:10.102.158.152 to 10.5.113.142 ID=3D512 seq=3D5376= length=3D40 44: ICMP echo-request: translating inside:10.102.158.152 to outside:10.10= 2.158.152 45: ICMP echo-request from inside:10.102.158.152 to 10.5.113.142 ID=3D512= seq=3D5632 length=3D40 46: ICMP echo-request: translating inside:10.102.158.152 to outside:10.10= 2.158.152 And When remote host try to ping a local machine, i can see the request= coming without any reply.=20 =20 To get the ping work , we have to reload it.=20 =20 Do you have any idea? =20 =20 Please find below my config file : PIX Version 6.3(5) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password N7FecZuSHJlVZC2P encrypted passwd N7FecZuSHJlVZC2P encrypted hostname pixbenin domain-name boabenin.bj fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list acl_vpn permit icmp 10.102.156.0 255.255.252.0 192.168.0.0 25= 5.255.255.0=20 access-list acl_vpn permit ip 10.102.156.0 255.255.252.0 192.168.0.0 255.= 255.255.0=20 access-list acl_blgo permit icmp 10.102.156.0 255.255.252.0 10.5.113.128 = 255.255.255.224=20 access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.5.113.128 25= 5.255.255.224=20 access-list acl_blgo permit icmp 10.102.156.0 255.255.252.0 10.102.128.0 = 255.255.254.0=20 access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.102.128.0 25= 5.255.254.0=20 access-list acl_blgo permit icmp 10.102.156.0 255.255.252.0 10.102.130.0 = 255.255.255.128=20 access-list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.102.130.0 25= 5.255.255.128=20 pager lines 24 mtu outside 500 mtu inside 1500 ip address outside 81.91.235.147 255.255.255.192 ip address inside 10.102.155.135 255.255.255.128 ip audit info action alarm ip audit attack action alarm pdm history enable arp timeout 14400 nat (inside) 0 10.102.156.0 255.255.252.0 0 0 route outside 0.0.0.0 0.0.0.0 81.91.235.129 1 route inside 10.102.156.0 255.255.252.0 10.102.155.129 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:0= 0:00 ip audit attack action alarm pdm history enable arp timeout 14400 nat (inside) 0 10.102.156.0 255.255.252.0 0 0 route outside 0.0.0.0 0.0.0.0 81.91.235.129 1 route inside 10.102.156.0 255.255.252.0 10.102.155.129 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:0= 0:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+=20 aaa-server TACACS+ max-failed-attempts 3=20 aaa-server TACACS+ deadtime 10=20 aaa-server RADIUS protocol radius=20 aaa-server RADIUS max-failed-attempts 3=20 aaa-server RADIUS deadtime 10=20 aaa-server LOCAL protocol local=20 no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec crypto ipsec transform-set strong esp-3des esp-sha-hmac=20 crypto dynamic-map dynmap 30 set transform-set strong crypto map toX 20 ipsec-isakmp crypto map toX 20 match address acl_vpn crypto map toX 20 set peer 196.200.82.35 crypto map toX 20 set transform-set strong crypto map toX 30 ipsec-isakmp crypto map toX 30 match address acl_blgo crypto ipsec transform-set strong esp-3des esp-sha-hmac=20 crypto dynamic-map dynmap 30 set transform-set strong crypto map toX 20 ipsec-isakmp crypto map toX 20 match address acl_vpn crypto map toX 20 set peer 196.200.82.35 crypto map toX 20 set transform-set strong crypto map toX 30 ipsec-isakmp crypto map toX 30 match address acl_blgo crypto map toX 30 set peer 194.78.211.130 crypto map toX 30 set transform-set strong crypto map toX 9990 ipsec-isakmp dynamic dynmap crypto map toX interface outside isakmp enable outside isakmp key ******** address 196.200.82.35 netmask 255.255.255.255=20 isakmp key ******** address 194.78.211.130 netmask 255.255.255.255=20 isakmp identity address isakmp policy 9 authentication pre-share isakmp policy 9 encryption 3des isakmp policy 9 hash sha isakmp policy 9 group 1 isakmp policy 9 lifetime 86400 isakmp policy 19 authentication pre-share isakmp policy 19 encryption 3des isakmp policy 19 hash sha isakmp policy 19 group 2 isakmp policy 19 lifetime 86400 telnet timeout 5 ssh 194.7.174.162 255.255.255.255 outside ssh 194.7.174.163 255.255.255.255 outside ssh 10.102.156.0 255.255.252.0 inside ssh 10.102.155.0 255.255.255.0 inside ssh timeout 5 console timeout 0 terminal width 80 Cryptochecksum:7458b1b938134f7d52ed82d4e2003210 =20 Regrds, =20 Kindy =20 =09 --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directem= ent vos services pr=E9f=E9r=E9s : v=E9rifiez vos nouveaux mails, lancez v= os recherches et suivez l'actualit=E9 en temps r=E9el. Cliquez ici. --0-1644056276-1147164956=:13201 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable <DIV>Hi,</DIV> <DIV> </DIV> <DIV>I am having a strange behaviour w= ith a Cisco PIX Firewall Version 6.3(5). The configuration is done , the = VPN are created between the 2 differents sites. The probl=E8me is after 5= to 6 hours of running, the ping to the remote hosts doesn't go through. = When i try to ping a remote host, I see the followings line in the debug = icmp trace: </DIV> <DIV> </DIV> <DIV>-request from inside:10.102.1= 58.152 to 10.5.113.142 ID=3D512 seq=3D5376 length=3D40<BR>44: ICMP echo-r= equest: translating inside:10.102.158.152 to outside:10.102.158.152<BR>45= : ICMP echo-request from inside:10.102.158.152 to 10.5.113.142 ID=3D512 s= eq=3D5632 length=3D40<BR>46: ICMP echo-request: translating inside:10.102= .158.152 to outside:10.102.158.152<BR></DIV> <DIV>And When remote host t= ry to ping a local machine, i can see the request coming without any repl= y. </DIV> <DIV> </DIV> <DIV>To get the ping work , we have to relo= ad it. </DIV> <DIV> </DIV> <DIV>Do you have any idea? </DIV> <DIV> </DIV> <DIV>Please find below my con= fig file :</DIV> <DIV>PIX Version 6.3(5)<BR>interface ethernet0 aut= o<BR>interface ethernet1 auto<BR>nameif ethernet0 outside security0<BR>na= meif ethernet1 inside security100<BR>enable password N7FecZuSHJlVZC2P enc= rypted<BR>passwd N7FecZuSHJlVZC2P encrypted<BR>hostname pixbenin<BR>domai= n-name boabenin.bj<BR>fixup protocol dns maximum-length 512<BR>fixup prot= ocol ftp 21<BR>fixup protocol h323 h225 1720<BR>fixup protocol h323 ras 1= 718-1719<BR>fixup protocol http 80<BR>fixup protocol rsh 514<BR>fixup pro= tocol rtsp 554<BR>fixup protocol sip 5060<BR>fixup protocol sip udp 5060<= BR>fixup protocol skinny 2000<BR>fixup protocol smtp 25<BR>fixup protocol= sqlnet 1521<BR>fixup protocol http 80<BR>fixup protocol rsh 514<BR>fixup= protocol rtsp 554<BR>fixup protocol sip 5060<BR>fixup protocol sip udp 5= 060<BR>fixup protocol skinny 2000<BR>fixup protocol smtp 25<BR>fixup prot= ocol sqlnet 1521<BR>fixup protocol tftp 69<BR>names<BR>access-list acl_vpn permit icmp 10.102.156.0 255.255.252.= 0 192.168.0.0 255.255.255.0 <BR>access-list acl_vpn permit ip 10.102.156.= 0 255.255.252.0 192.168.0.0 255.255.255.0 <BR>access-list acl_blgo permit= icmp 10.102.156.0 255.255.252.0 10.5.113.128 255.255.255.224 <BR>access-= list acl_blgo permit ip 10.102.156.0 255.255.252.0 10.5.113.128 255.255.2= 55.224 <BR>access-list acl_blgo permit icmp 10.102.156.0 255.255.252.0 10= .102.128.0 255.255.254.0 <BR>access-list acl_blgo permit ip 10.102.156.0 = 255.255.252.0 10.102.128.0 255.255.254.0 <BR>access-list acl_blgo permit = icmp 10.102.156.0 255.255.252.0 10.102.130.0 255.255.255.128 <BR>access-l= ist acl_blgo permit ip 10.102.156.0 255.255.252.0 10.102.130.0 255.255.25= 5.128 <BR>pager lines 24<BR>mtu outside 500<BR>mtu inside 1500<BR>ip addr= ess outside 81.91.235.147 255.255.255.192<BR>ip address inside 10.102.155= .135 255.255.255.128<BR>ip audit info action alarm<BR>ip audit attack act= ion alarm<BR>pdm history enable<BR>arp timeout 14400<BR>nat (inside) 0 10.102.156.0 255.255.252.0 0 0<BR>route = outside 0.0.0.0 0.0.0.0 81.91.235.129 1<BR>route inside 10.102.156.0 255.= 255.252.0 10.102.155.129 1<BR>timeout xlate 3:00:00<BR>timeout conn 1:00:= 00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00<BR>ip audit a= ttack action alarm<BR>pdm history enable<BR>arp timeout 14400<BR>nat (ins= ide) 0 10.102.156.0 255.255.252.0 0 0<BR>route outside 0.0.0.0 0.0.0.0 81= .91.235.129 1<BR>route inside 10.102.156.0 255.255.252.0 10.102.155.129 1= <BR>timeout xlate 3:00:00<BR>timeout conn 1:00:00 half-closed 0:10:00 udp= 0:02:00 rpc 0:10:00 h225 1:00:00<BR>timeout h323 0:05:00 mgcp 0:05:00 si= p 0:30:00 sip_media 0:02:00<BR>timeout sip-disconnect 0:02:00 sip-invite = 0:03:00<BR>timeout uauth 0:05:00 absolute<BR>aaa-server TACACS+ protocol = tacacs+ <BR>aaa-server TACACS+ max-failed-attempts 3 <BR>aaa-server TACAC= S+ deadtime 10 <BR>aaa-server RADIUS protocol radius <BR>aaa-server RADIU= S max-failed-attempts 3 <BR>aaa-server RADIUS deadtime 10 <BR>aaa-server LOCAL protocol local <BR>no snmp-serve= r location<BR>no snmp-server contact<BR>snmp-server community public<BR>n= o snmp-server enable traps<BR>floodguard enable<BR>sysopt connection perm= it-ipsec<BR>crypto ipsec transform-set strong esp-3des esp-sha-hmac <BR>c= rypto dynamic-map dynmap 30 set transform-set strong<BR>crypto map toX 20= ipsec-isakmp<BR>crypto map toX 20 match address acl_vpn<BR>crypto map to= X 20 set peer 196.200.82.35<BR>crypto map toX 20 set transform-set strong= <BR>crypto map toX 30 ipsec-isakmp<BR>crypto map toX 30 match address acl= _blgo<BR>crypto ipsec transform-set strong esp-3des esp-sha-hmac <BR>cryp= to dynamic-map dynmap 30 set transform-set strong<BR>crypto map toX 20 ip= sec-isakmp<BR>crypto map toX 20 match address acl_vpn<BR>crypto map toX 2= 0 set peer 196.200.82.35<BR>crypto map toX 20 set transform-set strong<BR= >crypto map toX 30 ipsec-isakmp<BR>crypto map toX 30 match address acl_bl= go<BR>crypto map toX 30 set peer 194.78.211.130<BR>crypto map toX 30 set transform-set strong<BR>crypto m= ap toX 9990 ipsec-isakmp dynamic dynmap<BR>crypto map toX interface outsi= de<BR>isakmp enable outside<BR>isakmp key ******** address 196.200.82.35 = netmask 255.255.255.255 <BR>isakmp key ******** address 194.78.211.130 ne= tmask 255.255.255.255 <BR>isakmp identity address<BR>isakmp policy 9 auth= entication pre-share<BR>isakmp policy 9 encryption 3des<BR>isakmp policy = 9 hash sha<BR>isakmp policy 9 group 1<BR>isakmp policy 9 lifetime 86400<B= R>isakmp policy 19 authentication pre-share<BR>isakmp policy 19 encryptio= n 3des<BR>isakmp policy 19 hash sha<BR>isakmp policy 19 group 2<BR>isakmp= policy 19 lifetime 86400<BR>telnet timeout 5<BR>ssh 194.7.174.162 255.25= 5.255.255 outside<BR>ssh 194.7.174.163 255.255.255.255 outside<BR>ssh 10.= 102.156.0 255.255.252.0 inside<BR>ssh 10.102.155.0 255.255.255.0 inside<B= R>ssh timeout 5<BR>console timeout 0<BR>terminal width 80<BR>Cryptochecksum:7458b1b938134f7d52ed82d4e2003210</DIV> <DIV><BR>Re= grds,</DIV> <DIV> </DIV> <DIV>Kindy</DIV> <DIV> </DIV><p> <hr size=3D"1" />=20 <b>Faites de Yahoo! votre page d'accueil sur le web</b> pour retrouver di= rectement vos services pr=E9f=E9r=E9s : v=E9rifiez vos nouveaux mails, la= ncez vos recherches et suivez l'actualit=E9 en temps r=E9el. <a href=3D"h= ttp://us.rd.yahoo.com/mail/mail_taglines/yahoofr/*http://fr.yahoo.com/set= " target=3D_blank>Cliquez ici</a>. --0-1644056276-1147164956=:13201-- --===============1404893481== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ VPN mailing list [email protected] http://lists.shmoo.com/mailman/listinfo/vpn --===============1404893481==--