[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2715
  • Last Modified:

PIX 506 Duplex speed change

I want to change the internal interface speed. For some reason my download speed has decreased to 70 Kbps. I have reset the pix a few times and reset the modem, the switch is new. I want to change the duplex speed on my internal interface. but it says..
ethernet1 can only be set to 10baseT, 10full or auto.

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname
domain-name
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
pager lines 24
interface ethernet0 10full
interface ethernet1 10full
hostname          
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.10.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp x.x.x.x pop3 192.168.10.2 pop3 netmask 255.255
.255.255 0 0
static (inside,outside) tcp x.x.x.x smtp 192.168.10.2 smtp netmask 255.255
.255.255 0 0
static (inside,outside) tcp x.x.x.x www 192.168.10.2 www netmask 255.255.2
55.255 0 0
static (inside,outside) tcp x.x.x.x 3389 192.168.10.2 3389 netmask 255.255
.255.255 0 0
static (inside,outside) tcp x.x.x.x https 192.168.10.2 https netmask 255.2
55.255.255 0 0
static (inside,outside) tcp x.x.x.x 4125 192.168.10.2 4125 netmask 255.255
.255.255 0 0
static (inside,outside) tcp x.x.x.x ftp 192.168.10.2 ftp netmask 255.255.2
55.255 0 0
static (inside,outside) tcp x.x.x.x 4899 192.168.10.21 4899 netmask 255.25
5.255.255 0 0
conduit permit tcp host x.x.x.x eq www any
conduit permit tcp host x.x.x.x eq 3389 any
conduit permit tcp host x.x.x.x eq smtp any
conduit permit tcp host x.x.x.x eq pop3 any
conduit permit tcp host x.x.x.x eq https any
conduit permit tcp host x.x.x.x eq 4125 any
conduit permit tcp host x.x.x.x eq ftp any
conduit permit tcp host x.x.x.x eq 4899 any
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 5
ssh timeout 5
dhcpd auto_config outside
terminal width 80


Does anyone see anything wrong with this config?
0
plimpias
Asked:
plimpias
  • 2
1 Solution
 
lrmooreCommented:
>PIX Version 6.2(2)
PIX OS 6.3(3) will give you 100Mb full duplex capability

>interface ethernet0 10full
>interface ethernet1 10full

If your switchport connected to Ethernet1 is not also set to 10/full you will have problems. If your switch is not managable and you can't set the speed/duplex, then leave the PIX interfaces at "auto"

   interface ethernet1 auto

Eventually, you will have to convert your conduits to access-lists.
0
 
plimpiasAuthor Commented:
My switch is not managable. however it is a GB switch. So your saying with 6.2 i can't do 100Full? unless i upgrade to 6.3?
0
 
lrmooreCommented:
Correct. But you don't really need 100full because you're throttled at the other side to, what 2Mb?
The issue is that the switchport is set to autonegotiate, your PIX is set to 10full. Manually setting the duplex turns off the autonegotiation packet. If the switch does not receive an autonegotiation packet, it will most likely fall back to half-duplex. Now you have a duplex mismatch that is the culprit in your slowness..
From the PIX console, use "show interface" and look for collisions and error counts. If there are any errors, especially collisions, the problem will point to a duplex mismatch.

6.3(3) brought my 506 up to 100/full capability, but I'm only plugged into a 10Mb switch anyway.
0

Featured Post

Choose an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now