Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1524
  • Last Modified:

pix 515 and syn flag problems

I have a pix 515 ( 6.3.3) in place and working well.  The outside interface is talking to a 2621 over a vlan...

isp ---------> 2621 outside int
                             |     < --- same vlan
                             |
                    pix outside int  -----> inside networks


I am changing routers and t1 providers... so I change all of my translates, accesslists, globals and routes to reflect the new public network.

the Pix and the new router can see each other AND anything that I put on the "public network VLAN"  but any traffic that the pix is supposed to pass to the inside network(s) come back with the error "inbound tcp connection denyed xxx.xxx.xxx.xxx/port to xxx.xxx.xxx.xxx/80 (or whatever port) SYN flag on interface outside" (in the syslog BTW)

after I change the acls and xlates i do a clear xlate, clear arp and dump the active connections...

I'm baffled and I am sure that it is something simple that I am missing


0
Nomad469
Asked:
Nomad469
  • 2
2 Solutions
 
hawgpigCommented:
With out a config I can't tell...
Check your access-lists and make sure they are in the correct format.....
and make sure your statics are correct...
Access-lists should look like this
access-list permit tcp [source address] [external translated address on pix] eq port
statics should look like this
static (high security interface name, low security interface name) [low security IP ADDRESS] [high security IP ADDRESS] netmask 255.255.255.255
static (inside,outside) 67.56.45.34 192.168.10.1 netmask 255.255.255.255
Hope this helps...
basically the message you are getting.....is denying PER YOUR SECURITY SETTINGS....
Just double check the syntax on your config...
good Luck
0
 
hawgpigCommented:
I think this is the message you are getting...
This is off the cisco site...

Log Message %PIX-2-106001: Inbound TCP connection denied from IP_addr/port to IP_addr/port flags TCP_flags

Explanation   This is a connection-related message. This message occurs when an attempt to connect to an inside address is denied by your security policy. Possible TCP_flags values correspond to the flags in the TCP header that were present when the connection was denied. For example, a TCP packet arrived for which no connection state exists in the PIX Firewall, and it was dropped. The TCP_flags in this packet are FIN,ACK.

The TCP_flags are as follows:

ACK—The acknowledgment number was received.


FIN—Data was sent.


PSH—The receiver passed data to the application.


RST—The connection was reset.


SYN-—Sequence numbers were synchronized to start a connection.


URG—The urgent pointer was declared valid.


Recommended Action   None required.

0
 
Nomad469Author Commented:
Ok... I feel rather lame on this one ... I hope that cisco isn't watching they'll want my cert back !!
It was connection based ... when I did the command set in word pad to do all of the changes at the same time ... I did a no on the outside acl without turning it back on ... oopps ! It was something simple... a silly little missing permission. D'oh.

Its working correctly now ... thanks for all your help!
0

Featured Post

New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now