• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 278
  • Last Modified:

NT delayed acknowledgement of packets across ASA

For security purposes I have dedicated an interface ("ntnet" interface) on our Cisco ASA5520 for NT systems. NT access from the "ntnet" interface to files located on systems on the "inside" interface is insanely slow. The NT systems have no issue if they are located on the same interface as the systems they are trying to access. XP systems don't seem to have an issue no matter where they are located. Packet traces show a delay in NT acknowledging receipt of packets. This is happening with multiple NT systems. All systems use identical hardware. Does this make any sense. I would love to ditch NT but it is required by a contract.
0
L3MS
Asked:
L3MS
  • 3
  • 3
1 Solution
 
lrmooreCommented:
NT is highly dependent on NetBIOS which is not carried across the ASA interfaces. Do you have a WINS server, and where is it located - on the ntnet side or the inside? Do all systems register to the WINS server? If you don't have one, then it would be best to set one up on the ntnet side and force all systems to register to it - this means you have to enable netbios on XP and put in the WINS server IP (can be done via DHCP)
0
 
L3MSAuthor Commented:
Good old WINS. Didn't think of that one. The WINS servers are on the "inside". I'll set up a WINS server on "ntnet" and see what happens. The systems on the "ntnet" are registering correctly with WINS on the "inside".
0
 
L3MSAuthor Commented:
The WINS server is up and running and replicating with the servers on the "inside". All seems well with WINS. Performance is still miserable.
0
Shaping tomorrow’s technology leaders, today

The leading technology companies all recognize the growing need for gender diversity. Through its Women in IT scholarship program, WGU is working to reverse this trend by empowering more women to earn IT degrees and become tomorrow’s tech-industry leaders.  

 
lrmooreCommented:
OK. How about the interface between ASA and the switch? Is it hard-set to speed/duplex or is it on auto? Could be a duplex mismatch. Look at ASA interface with show interface and look for error counters, especially collisions. Do the same on the switchport and look for error counters.
Do you have a subnet static nat on the ASA something like this:
 static (inside,ntnet) insidesubnet insidesubnet netmask 255.255.255.0

What do you have as an access-list applied to the ntnet interface? Are both interfaces same security level? If yes do you have same security traffic permit inter-interface enabled?
0
 
L3MSAuthor Commented:
I found the problem. It turns out that the NT NIC driver needed to be updated to the latest and greatest of 02-12-2002. I'm not quite sure why the driver would make this sort of difference especially. I wasn't seeing any unusual traffic just slow responses.
0
 
lrmooreCommented:
D'OH! Thanks for the report back. Nice sleuthing my friend.
0
 
Computer101Commented:
PAQed with points refunded (500)

Computer101
EE Admin
0

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now