Go Premium for a chance to win a PS4. Enter to Win


PIX 501 - SYN Timeout problem

Posted on 2004-04-08
Medium Priority
Last Modified: 2008-03-10
Hello - BT have fixed my adsl line, However I am not getting any emails that are sent to our exchange server. The log's give the following line:

Teardown TCP connection 146 for outside to inside: duration 0:02:01 bytes 0 SYN Timeout

Here is the current config the pix is running

: Saved
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password blahblah.blah encrypted
passwd blahblah.blah encrypted
hostname GWpix
domain-name GRAINGER
no fixup protocol dns
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
access-list acl_out permit tcp host interface outside eq smtp
access-list acl_out permit tcp host interface outside eq smtp
access-list acl_out permit tcp host interface outside eq smtp
access-list acl_out permit tcp any interface outside eq smtp
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside
ip address inside
ip audit info action alarm
ip audit attack action alarm
pdm location inside
pdm location outside
pdm location outside
pdm location outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0 0
static (inside,outside) tcp interface smtp smtp netmask 0 0
access-group acl_out in interface outside
established tcp 25 0 permitto tcp 1024-65535 permitfrom tcp 0
established tcp 135 0 permitto tcp 1024-65535 permitfrom tcp 0
route outside 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
: end

Thank you for any assistance.
Question by:GWbjones
  • 4
  • 4

Expert Comment

ID: 10789021
   This means that the mail server sent a SYN....and it timed out on the pix after waiting for a SYN-ACK for 2 minutes....
Something is wrong with your e-mail server.....
Check the configuration or reboot the server and try again....
To confirm that this is the issue you can test that the pix is passing traffic on port 25 by using an outside connection and telneting to the outside IP address on port 25.
use this command
telnet 25 (where is your mail servers EXTERNAL address.)
If you get a black screen then the pix passed the traffic to the SMTP server and connected...
If you get a connection timed out...then the server is usually down or the pix is not passing the traffic.....see what the syslog says also....
Good Luck

Expert Comment

ID: 10789028
aaaaa. When I say the Mail server....I mean on the ISPs side....Sorry....

Author Comment

ID: 10802707
I have tried telneting into the PIX and after a little while it time outs. After looking at the log it had the same message as the email. So i need to understand what this SYN is and why its needed. Also could this to do with my exchange server not been able to communicate back to the source of the request?
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.


Accepted Solution

hawgpig earned 800 total points
ID: 10803416
THe way a computer connects to another computer is through the three way hadnshake.....
What is happening is the external computer is sending a SYN, and your internal computer is not responding with a SYN-ACK......After 2 minutes the PIX knows that there has been no connectin so it TIMESOUT the connection and kills the embryonic connection......Embryonic meaning a connection that has not been completed...
Check your e-mail server and make sure it is properly configured.....
THe internal computer is not acknowleging the connection...
Good Luck....

Author Comment

ID: 10868771
I really dont think this is the mail servers fault.
I got the mail switched back to our old connection and it works without a problem.

Is there a setting on the pix that could be messing the SYN up?

Author Comment

ID: 10869084
What i just said was basically utter rubbish - just as i hit "submit" i was thinking how does my mail server know where to send the SYN-ACK!!!!
It didnt and as soon as i sorted that it all worked fine.
Thanks Hawgpig for the help - your answers gave me the info i needed to fix it and test it. Thanks again and here are the points.

Expert Comment

ID: 10873723
You're welcome GWb
Glad I could help

Expert Comment

ID: 11600820

I am having the same sort of problem with clients on a network accessing a remote site through a PIX 525 UR Bun. The error message "duration 0:02:01 bytes 0 SYN Timeout" I have read this post and understand the solution, however, how do I configure my client to send the SYN-ACK back to the remote site ??? Are we talking about DNS entires here ?

Author Comment

ID: 11600910
Yes - Basically.
We use a DHCP server for which I had put the details in for connecting thro the gateway - My problem was because i had not put the DNS details into the DHCP servers network settings. Therefore all the clients new were the gateway was but the DHCP/Mail server didnt!

Hope that helps

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

783 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question