Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

PIX 515 dropping connection

Posted on 2002-05-29
18
Medium Priority
?
639 Views
Last Modified: 2009-07-29
I have a PIX 515 doing security and site to site VPN. I have three locations using 506's to connect. Periodically the PIX 515 will drop connection and I have to cycle the power to get the connection back. Once I do that the other sites are ok.

Should I add more memory or something??? I guess i'm not sure where to start troubleshooting.

Thanks for any Help.

slotz
0
Comment
Question by:slotz
18 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 7043272
Check your serial number. There was a whole batch of PIX's that were recalled:

http://www.cisco.com/warp/customer/770/fn9871.shtml

0
 

Author Comment

by:slotz
ID: 7043347
Is there a web site i can check this on??
0
 

Author Comment

by:slotz
ID: 7043377
Is there a web site i can check this on??
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:slotz
ID: 7043396
Is there a web site i can check this on??
0
 

Author Comment

by:slotz
ID: 7043400
sorry i missed your link,,,sorry for the duplicates too.

slotz
0
 

Author Comment

by:slotz
ID: 7043539
I can't seem to get into the secure web site to check.

can i give you the serial number to check for me

slotz
0
 

Author Comment

by:slotz
ID: 7043575
I can't seem to get into the secure web site to check.

can i give you the serial number to check for me

slotz
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 7044523
Sure..

If you have a unit with a serial number in the affected range which is experiencing the symptoms outlined in this Field Notice, contact the Technical Assistance Center (TAC) to request a return materials authorization (RMA) to replace the unit.


Only units manufactured in 1999 and early 2000 are affected. They may be identified by their serial numbers:

PIX 515 Serial Number Ranges Year Manufactured Serial Numbers Affected?
1999 44403010000 through 44403529999 Yes
2000 (early) 44404010000 through 44404169999 Yes
2000 (early) 44480010000 through 44480169999 Yes
2000 (later) 44404170000 through 44404529999 No
2000 (later) 44480170000 through 44480529999 No
2001 444050000 and later No
2001 444810000 and later No

PIX 515 units dispatched from service depots after September 2000 will not exhibit this fault, even if their serial number falls within the affected range.  

PIX Firewall Serial Numbers
PIX 525 serial numbers as reported by the show version command have their first two characters truncated. For example, if the PIX chassis serial number is 44480521234 it will be reported by show version as 480521234. The first two characters cut off are always 44.

If your serial number matches, contact tac@cisco.com
0
 

Author Comment

by:slotz
ID: 7045100
No go on the serial no. mine was in the 44405 range in 2001.

Thank you very much for that info though.


Any other thoughts??

slotz
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 7045133
what version OS on the PIX??
0
 

Author Comment

by:slotz
ID: 7045149
No go on the serial no. mine was in the 44405 range in 2001.

Thank you very much for that info though.


Any other thoughts??

slotz
0
 

Author Comment

by:slotz
ID: 7045155
version 5.2(5)

32mb Ram
Flash i28f640j5 0x300, 16mb
BIOS flash AT29C257 @ 9xfffd8000, 32kb
0
 
LVL 56

Expert Comment

by:andyalder
ID: 7045369
Look at the label on it's bottom. "800-05622-02 A0" or greater should be OK.

lrmoore, any idea on whether http://www.experts-exchange.com/networkgen/Q_20305792.html is a PIX or win2k problem?
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 7045419
It's possible in tduplantis' case that the switch between the PIX and the server may have an arp cache issue or limit, but if it is just this one particular IP address every time, you may have hit on something with the subnet mask...
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 7045458
Slotz,

Does just the VPN traffic stop, or does all traffic stop?
How much other traffic is coming through besides the VPN's? Is your restricted license enough?

Have you setup the tunnels as in this document?
http://www.cisco.com/warp/public/110/38.html

Check the arp timeout. You might want to increase the timeout value.

Also, I would upgrade the OS version. There are at least 239 known bugs in that version. I like 6.2 myself...

There is another recall of on-board FE cards:
http://www.cisco.com/warp/public/770/fn15028.shtml
If you can't get to this link either:
Products Affected
Product Comments
PIX-1FE   One 10/100 Mbps Ethernet Interface, RJ45 (option)  
PIX-1FE=   One 10/100 Mbps Ethernet Interface, RJ45 (spare)  

Problem Description
Between July 30, 2001, and August 9, 2001, some PIX-1FE cards shipped from Cisco contained the i82550 Ethernet controller chip. This chip is not supported by the PIX operating system and these cards may not function properly when installed in PIX firewalls.

Background
The vendor supplying Cisco with Ethernet interface cards substituted a different model without notifying Cisco in advance. The i82550 Ethernet controller chip is very similar in function to the supported chips and initially passed production tests. Since this substitution has been discovered and corrected, Cisco has modified its testing to verify the Ethernet controller type.

Problem Symptoms
When an unsupported interface card is installed in a PIX firewall, the following symptoms may occur:

The incorrect interface card may not be recognized in ROM monitor mode and may fail to TFTP PIX or PDM images. The system may stop responding or "hang" when a TFTP transfer is initiated.

The incorrect interface card may cause the system to hang or reboot during the boot process.

The incorrect interface card may cause some systems (in particular the PIX 525) to hang or reboot during the execution of a show interface command.

In all situations where the Ethernet interface controller type is reported (ROM monitor mode, show interface, etc.), the i82550 controller is reported as hardware type i82557. Note that in the past i82557 interface cards were shipped as PIX-1FE units. Refer to the "How To Identify Hardware Levels" section below for more details.
In addition, newer PIX OS releases including 6.1(1) and future maintenance releases of older release trains (6.0, 5.3, etc.) will disable the card with a message like the following at boot time:

      Cisco Secure PIX Firewall BIOS (4.0) #0: Thu Mar 2 22:59:20 PST 2000
      Platform PIX-515
      Flash=i28F640J5 @ 0x300
     
      Use BREAK or ESC to interrupt flash boot.
      Use SPACE to begin flash boot immediately.
      Reading 2466304 bytes of image from flash.
      32MB RAM
      Ignoring PCI card in slot:2 (vendor:0x8086 deviceid:0x1229 revisionid:0xc)
      Flash=i28F640J5 @ 0x300
    BIOS Flash=AT29C257 @ 0xfffd8000

Workaround/Solution
The solution is to replace the incorrect PIX-1FE interface card with the correct card. Customers who wish to replace one or more of their cards should contact the Technical Assistance Center (TAC) and request a return materials authorization (RMA) for the affected cards.

How To Identify Hardware Levels
To identify the card from the command line, issue the show interface command. This command shows the hardware type of every installed interface card. The cards with the incorrect i82550 controller are reported as i82557 hardware types. The i82557 controller, except the 535 model, is supported by the PIX but Cisco has not shipped it for two years. Therefore, it is most likely that recently received PIX-1FE cards reported as type i82557 are the unsupported i82550 model.

 Caution: Some PIX models (notably the 525) containing the i82550-based card may stop responding when the show interface command is executed. If the units are in production, it's recommended that you issue this command during off hours.

pixfirewall# show interface
interface ethernet0 "outside" is administratively down, line protocol is down
Hardware is i82557 ethernet, address is 0005.3290.024e
IP address 127.0.0.1, subnet mask 255.255.255.255
...

The printing on the Ethernet controller chips may positively identify the cards. The Ethernet controller type (8255x) is all that matters; the other text, including the location (Philippines versus Korea, year, and so on), is inconsequential.

Ethernet Controller i82557 i82558 i82559 i82550
Supported Yes (except 535) Yes Yes No
Sample Printing on Chip S82557 SB82558B GD82559 82550EY
Sample Picture    

Physical Replacement of Parts


0
 
LVL 79

Accepted Solution

by:
lrmoore earned 400 total points
ID: 7045460
Here is another field notice that might affect your serial number:
http://www.cisco.com/warp/public/770/fn15490.shtml

Field Notice:
PIX 515 and 506 Hang
Updated May 3, 2002
October 18, 2001

--------------------------------------------------------------------------------

More Field Notices

--------------------------------------------------------------------------------

Products Affected
Product Comments
PIX-515   PIX 515 Firewall (including all bundles)  
PIX-515-DC   PIX 515 DC Firewall (including all bundles)  
PIX-506   PIX 506 Firewall  

Serial Numbers
Sequential Number
44405200000 - 44405399999
44481200000 - 44481399999

Problem Description
Some PIX 515 systems will hang and become unresponsive, typically triggered by higher traffic throughput levels. PIX 506 systems may also be affected, however they are rarely used in environments where traffic throughput levels will reach the levels necessary to induce the hang.

This failure occurs regardless of the PIX OS version installed.  

Background
A new component source was introduced to the 515 and 506 production in May 2001. The new component's timing was slightly different than that on previous units. This timing differential leads to instabilities in the system and creates the potential for a system hang.

On October 2, 2001 this timing error was corrected in production.  

Problem Symptoms
When the PIX hangs, all interfaces stop passing traffic and the console port becomes unresponsive. No crash or stack trace is seen on the console port, and the system does not reboot on its own. The only way to return the unit to operation is by manually resetting the power.

If a stack trace is reported on the console port or if the system reboots on its own then this failure is not being experienced and further troubleshooting should be performed on the configuration and software.  

Workaround/Solution
Workaround

The only potential workaround is to reduce the traffic throughput level to the point where the hang does not occur. Levels under 15 mbit/second may be sufficiently low, however this varies from unit to unit and it may be impossible to avoid the hang on some units. You may be able to reduce the traffic levels by hard coding all interfaces to 10BaseT, or via means external to the PIX.

Solution

The solution is to replace the failed hardware.

PIX 515 and 506 systems manufactured as of October 2nd, 2001 are free of this problem. A global purge of the service depot stock has been completed as of October 26th, 2001. All PIX systems replaced by the return materials authorization (RMA) process are free of this problem.

Customers who wish to replace one or more of their systems which are failing due to the problem described in this field notice should contact the Technical Assistance Center by following the instructions at the end if this notice and request a standard RMA.

DDTS
To follow the bug ID link below and see detailed bug information, you must be a registered user and you must be logged in.

DDTS Description
CSCds19881 PIX 515 hangs and does not respond to console access no traffic pass.

How To Identify Hardware Levels
0
 
LVL 3

Expert Comment

by:mbruner
ID: 7052346
When you say that your connection is dropped, exactly what do you mean by connection?  Does this affect all traffic going through the PIX, or does it only affect your VPN connections?
0
 

Author Comment

by:slotz
ID: 7052388
hey guys

Every pix I own is going to be replaced by the recall. I'll give irmoore the points since he's the one that gave me the recall stuff. I'll see what happens after i get them .

Thanks to all

slotz
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen some questions on problems with SSH/telnet access to Cisco routers that may occur despite the fact that from a PC connected to your LAN, Internet connectivity is in place and users can access Internet sites without any issues.  There are…
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

972 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question