PIX Firewall / Network Address Translation
Got a problem, and I've no clue where to start. (Unfortunately, I'm not the one who gets to make decisions here, they just want me to fix what they break.)
We've got a new Cisco PIX Firewall installed, and it's supposed to be handling our Network Address Translation. (NAT.) However, it was configured to do Port Address Translation (PAT) on the IP of the PIX's interface. After awhile, my users would complain to me that they would often try to go to a website and have to hit "refresh" a number of times before their sites would come up. I was under the ASSUMPTION that this was because the PAT was running out of ports for all of the users. We have an address pool ranging from x.x.x.146 (the PIX) to x.x.x.155, with .147 being our mail server. So I switched the settings on the PIX to do a "Range" from .148 to .155. This seems to have only caused MORE trouble.
Anyone have any suggestions?
-Javin
We've got a new Cisco PIX Firewall installed, and it's supposed to be handling our Network Address Translation. (NAT.) However, it was configured to do Port Address Translation (PAT) on the IP of the PIX's interface. After awhile, my users would complain to me that they would often try to go to a website and have to hit "refresh" a number of times before their sites would come up. I was under the ASSUMPTION that this was because the PAT was running out of ports for all of the users. We have an address pool ranging from x.x.x.146 (the PIX) to x.x.x.155, with .147 being our mail server. So I switched the settings on the PIX to do a "Range" from .148 to .155. This seems to have only caused MORE trouble.
Anyone have any suggestions?
-Javin
How many user do you have behind the PIX? It should take quite a few to exhaust the overloaded PAT address.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
billwharton:
I think I understand what you're saying, and I think it's the same conclusion I came to before. Doing a "Range" setup actually maps the users to the outside IPs, giving them all ports on an IP mapped to their own. Thus, 7 IPs = 7 Users online.
I've switched it back over to "interface PAT" in the meantime, where the ports of the PIX's IP were being utilized for the port address translation. This brings us back to our original problem.
Based on what you said, I tried adding each additional IP to the same "pool" (by default, 10) as a PAT IP, and removed the "interface PAT" (which is the PIX's IP). This gives me the 7 IPs (in theory) running port address translation. If this IS what you were talking about, and is what I should do, let me know.
The thing that bothers me about this whole thing, is that I understand that each hit to a webpage can make up to half a dozen connections, and those connections can hang on for 2-15 minutes. But would you REALLY be likely to run out of ports for translation, even with one IP, with only 40 users on the network?
-Javin
I think I understand what you're saying, and I think it's the same conclusion I came to before. Doing a "Range" setup actually maps the users to the outside IPs, giving them all ports on an IP mapped to their own. Thus, 7 IPs = 7 Users online.
I've switched it back over to "interface PAT" in the meantime, where the ports of the PIX's IP were being utilized for the port address translation. This brings us back to our original problem.
Based on what you said, I tried adding each additional IP to the same "pool" (by default, 10) as a PAT IP, and removed the "interface PAT" (which is the PIX's IP). This gives me the 7 IPs (in theory) running port address translation. If this IS what you were talking about, and is what I should do, let me know.
The thing that bothers me about this whole thing, is that I understand that each hit to a webpage can make up to half a dozen connections, and those connections can hang on for 2-15 minutes. But would you REALLY be likely to run out of ports for translation, even with one IP, with only 40 users on the network?
-Javin
Well, I don't exactly understand your last post completely.
Are you comfortable using interface PAT for the long term? There is no reason why you should. Hence, you can simply forget about ip to ip nat since that isin't needed in this place.
Interface PAT should not give you any problems. I've had environments running more than 10,000 connections on a PIX 515 using just one IP.
Are you comfortable using interface PAT for the long term? There is no reason why you should. Hence, you can simply forget about ip to ip nat since that isin't needed in this place.
Interface PAT should not give you any problems. I've had environments running more than 10,000 connections on a PIX 515 using just one IP.
Javin
The posting by tpacc was actually authored by me. You can reply to it.
The posting by tpacc was actually authored by me. You can reply to it.
ASKER
Well, thus far, interface PAT has given us issues that we didn't have before (on the old network) when doing network address translation (NAT) through software.
It didn't make sense to me that 40 users would crowd out all the connections on Interface PAT to start with, but either way, we're running into this issue. And the issue has ONLY come about since installing the PIX, and ONLY happens when there are a "lot" of users online at once. The question here is how to fix the problem, whatever it may be. Do you have any suggestion for troubleshooting that I can use to chase down the issue?
-Javin
It didn't make sense to me that 40 users would crowd out all the connections on Interface PAT to start with, but either way, we're running into this issue. And the issue has ONLY come about since installing the PIX, and ONLY happens when there are a "lot" of users online at once. The question here is how to fix the problem, whatever it may be. Do you have any suggestion for troubleshooting that I can use to chase down the issue?
-Javin
try the 'show xlate' command when users complain and see how many connections do you see in there.
Also try 'show cpu usage'
Also try 'show cpu usage'
ASKER
Remember that I'm not using the terminal connection, but I'm using the PIX GUI.
-Javin
-Javin
No problem
in PDM, you have a section called 'monitoring'
Click on that and you would find multiple options on left including System graphs -> CPU and Connection graphs -> xlates
Check all of those to see the PIX is running fine.
in PDM, you have a section called 'monitoring'
Click on that and you would find multiple options on left including System graphs -> CPU and Connection graphs -> xlates
Check all of those to see the PIX is running fine.
ASKER
Will have to get back to you next week. Work's done for the weekend. ;)
-Javin
-Javin
ASKER
Well, things seem to be straightened out, now. I don't know how, but the users DID seem to be using up all the ports. Having added the additional IPs appears to have fixed the problem. Thanks for the help!
-Javin
-Javin