PIX 501 - SYN Timeout problem

Hello - BT have fixed my adsl line, However I am not getting any emails that are sent to our exchange server. The log's give the following line:

Teardown TCP connection 146 for outside to inside: duration 0:02:01 bytes 0 SYN Timeout

Here is the current config the pix is running

: Saved
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password blahblah.blah encrypted
passwd blahblah.blah encrypted
hostname GWpix
domain-name GRAINGER
no fixup protocol dns
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list acl_out permit tcp host interface outside eq smtp
access-list acl_out permit tcp host interface outside eq smtp
access-list acl_out permit tcp host interface outside eq smtp
access-list acl_out permit tcp any interface outside eq smtp
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
ip audit info action alarm
ip audit attack action alarm
pdm location inside
pdm location outside
pdm location outside
pdm location outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0 0
static (inside,outside) tcp interface smtp smtp netmask 0 0
access-group acl_out in interface outside
established tcp 25 0 permitto tcp 1024-65535 permitfrom tcp 0
established tcp 135 0 permitto tcp 1024-65535 permitfrom tcp 0
route outside 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
: end

Thank you for any assistance.
Who is Participating?
hawgpigConnect With a Mentor Commented:
THe way a computer connects to another computer is through the three way hadnshake.....
What is happening is the external computer is sending a SYN, and your internal computer is not responding with a SYN-ACK......After 2 minutes the PIX knows that there has been no connectin so it TIMESOUT the connection and kills the embryonic connection......Embryonic meaning a connection that has not been completed...
Check your e-mail server and make sure it is properly configured.....
THe internal computer is not acknowleging the connection...
Good Luck....
   This means that the mail server sent a SYN....and it timed out on the pix after waiting for a SYN-ACK for 2 minutes....
Something is wrong with your e-mail server.....
Check the configuration or reboot the server and try again....
To confirm that this is the issue you can test that the pix is passing traffic on port 25 by using an outside connection and telneting to the outside IP address on port 25.
use this command
telnet 25 (where is your mail servers EXTERNAL address.)
If you get a black screen then the pix passed the traffic to the SMTP server and connected...
If you get a connection timed out...then the server is usually down or the pix is not passing the traffic.....see what the syslog says also....
Good Luck
aaaaa. When I say the Mail server....I mean on the ISPs side....Sorry....
The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

GWbjonesAuthor Commented:
I have tried telneting into the PIX and after a little while it time outs. After looking at the log it had the same message as the email. So i need to understand what this SYN is and why its needed. Also could this to do with my exchange server not been able to communicate back to the source of the request?
GWbjonesAuthor Commented:
I really dont think this is the mail servers fault.
I got the mail switched back to our old connection and it works without a problem.

Is there a setting on the pix that could be messing the SYN up?
GWbjonesAuthor Commented:
What i just said was basically utter rubbish - just as i hit "submit" i was thinking how does my mail server know where to send the SYN-ACK!!!!
It didnt and as soon as i sorted that it all worked fine.
Thanks Hawgpig for the help - your answers gave me the info i needed to fix it and test it. Thanks again and here are the points.
You're welcome GWb
Glad I could help

I am having the same sort of problem with clients on a network accessing a remote site through a PIX 525 UR Bun. The error message "duration 0:02:01 bytes 0 SYN Timeout" I have read this post and understand the solution, however, how do I configure my client to send the SYN-ACK back to the remote site ??? Are we talking about DNS entires here ?
GWbjonesAuthor Commented:
Yes - Basically.
We use a DHCP server for which I had put the details in for connecting thro the gateway - My problem was because i had not put the DNS details into the DHCP servers network settings. Therefore all the clients new were the gateway was but the DHCP/Mail server didnt!

Hope that helps
All Courses

From novice to tech pro — start learning today.