Solved

pix 515 and syn flag problems

Posted on 2004-04-11
3
1,512 Views
Last Modified: 2013-11-16
I have a pix 515 ( 6.3.3) in place and working well.  The outside interface is talking to a 2621 over a vlan...

isp ---------> 2621 outside int
                             |     < --- same vlan
                             |
                    pix outside int  -----> inside networks


I am changing routers and t1 providers... so I change all of my translates, accesslists, globals and routes to reflect the new public network.

the Pix and the new router can see each other AND anything that I put on the "public network VLAN"  but any traffic that the pix is supposed to pass to the inside network(s) come back with the error "inbound tcp connection denyed xxx.xxx.xxx.xxx/port to xxx.xxx.xxx.xxx/80 (or whatever port) SYN flag on interface outside" (in the syslog BTW)

after I change the acls and xlates i do a clear xlate, clear arp and dump the active connections...

I'm baffled and I am sure that it is something simple that I am missing


0
Comment
Question by:Nomad469
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 4

Assisted Solution

by:hawgpig
hawgpig earned 500 total points
ID: 10803508
With out a config I can't tell...
Check your access-lists and make sure they are in the correct format.....
and make sure your statics are correct...
Access-lists should look like this
access-list permit tcp [source address] [external translated address on pix] eq port
statics should look like this
static (high security interface name, low security interface name) [low security IP ADDRESS] [high security IP ADDRESS] netmask 255.255.255.255
static (inside,outside) 67.56.45.34 192.168.10.1 netmask 255.255.255.255
Hope this helps...
basically the message you are getting.....is denying PER YOUR SECURITY SETTINGS....
Just double check the syntax on your config...
good Luck
0
 
LVL 4

Accepted Solution

by:
hawgpig earned 500 total points
ID: 10803558
I think this is the message you are getting...
This is off the cisco site...

Log Message %PIX-2-106001: Inbound TCP connection denied from IP_addr/port to IP_addr/port flags TCP_flags

Explanation   This is a connection-related message. This message occurs when an attempt to connect to an inside address is denied by your security policy. Possible TCP_flags values correspond to the flags in the TCP header that were present when the connection was denied. For example, a TCP packet arrived for which no connection state exists in the PIX Firewall, and it was dropped. The TCP_flags in this packet are FIN,ACK.

The TCP_flags are as follows:

ACK—The acknowledgment number was received.


FIN—Data was sent.


PSH—The receiver passed data to the application.


RST—The connection was reset.


SYN-—Sequence numbers were synchronized to start a connection.


URG—The urgent pointer was declared valid.


Recommended Action   None required.

0
 
LVL 1

Author Comment

by:Nomad469
ID: 10821383
Ok... I feel rather lame on this one ... I hope that cisco isn't watching they'll want my cert back !!
It was connection based ... when I did the command set in word pad to do all of the changes at the same time ... I did a no on the outside acl without turning it back on ... oopps ! It was something simple... a silly little missing permission. D'oh.

Its working correctly now ... thanks for all your help!
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco ASA 5506W VPN Clients not seeing local network 12 78
Limit traffic to specific Cisco port? 12 79
VoIP Polycom Phones not working 30 70
ASA NAT rule change 3 86
Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question