PIX does not allow packets loarge

I can ping with l - 992, but fail with-l 993.

Ping 172.16.17.1 with 992 bytes of data:

Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

Reply from 172.16.17.1: bytes = 992 time = 1ms TTL = 254

Ping statistics for 172.16.17.1:

Packets: Sent = 4, received = 4, lost = 0 (0% loss),

Time approximate round trip in milli-seconds:

Minimum = 1ms, Maximum = 1ms, average = 1ms

Ping 172.16.17.1 with 993 bytes of data:

Request timed out.

Request timed out.

Request timed out.

Request timed out.

Ping statistics for 172.16.17.1:

Packets: Sent = 4, received = 0, lost = 4 (100% loss),

I also see that attached to the devices in the DMZ are taken excessively long time.

The MTU size on all interfaces is always the default value of 1500.

Hi Jimmysturn:

Which is likely happened here is that you have ID political attack linked to your external interface with the action 'drop' or 'reset' all packages that match the signature in the category of the attack.

Signature 2151 (large ICMP) will drop packets hit the PIX off interface or those who pass through the PIX outside interface when you ping with large packet size (+ 993 bytes):

From your post, you must have had the following policy of IDS on your PIX:

IP audit name attackpolicy attack action fall

(or

IP audit name attackpolicy action fall attack alarm

or

attack IP audit name attackpolicy raz action alarm

or both)

If you want to ping with big package, there are several things you can do:

(1) remove the policy of "attackpolicy" completely from your external interface. It will turn off all of the IDS signatures in the category of the attack.

Carefully look at this and see if it's what you want to do.

To achieve the above, issue the following command:

"no interface verification ip outside of attackpolicy"

(2) turn off the signature 2151 by running the command:

"disable signature verification ip 2151.

That would disable only the big signing of ICMP attack while leaving the other signatures of attacks in the category of GIS attack ON.

(3) set signature action to open a session (a syslog server or the internal buffer) large ICMP packets instead of dropping. Again, this should be determined carefully as option 1.

To achieve the above goal, issue the following command:

IP audit alarm action name attackpolicy attack

It will be useful.

Please indicate the position accordingly if you find it useful.

Sincerely,

Binh

Tags: Cisco Security

Similar Questions

Maybe you are looking for