|
Slow PIX 501I have firewalled my office network from our campus network with a PIX 501. I am getting extreemly slow throughput through the firewall. I max out at about 130KB/s with a more typical throughput of 40-50KB/s. Just for fun I installed a linksys firewall BEFSX41 and got 1.4MB/s. I am perplexed, I bought the cisco so I could get wire-speed. MY config follows.
: Saved : PIX Version 6.3(3) interface ethernet0 10baset interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 enable password xxx encrypted passwd xxx encrypted hostname mote domain-name lindstrom.org fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol ils 389 fixup protocol rsh 514 fixup protocol rtsp 554 fixup protocol sip 5060 fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 names access-list outside_in permit tcp any host x.y.z.242 eq www access-list outside_in permit tcp any host x.y.z.243 eq www access-list outside_in permit tcp any host x.y.z.242 eq smtp access-list outside_in permit tcp any host x.y.z.242 eq pop3 access-list outside_in permit tcp any host x.y.z.242 eq imap4 access-list outside_in permit tcp any host x.y.z.242 eq 3389 access-list outside_in permit tcp any host x.y.z.242 eq domain access-list outside_in permit udp any host x.y.z.242 eq domain access-list outside_in permit gre any host x.y.z.242 access-list outside_in permit tcp any eq pptp host 128.187.147.242 access-list outside_in permit tcp any host x.y.z.242 eq https pager lines 24 mtu outside 1500 mtu inside 1500 ip address outside dhcp ip address inside 10.3.0.254 255.255.255.0 ip audit info action alarm ip audit attack action alarm pdm location 10.3.0.0 255.255.255.0 inside pdm location 10.3.0.1 255.255.255.255 inside pdm location 10.3.0.2 255.255.255.255 inside pdm location 10.3.0.5 255.255.255.255 inside pdm logging informational 100 pdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) x.y.z.242 10.3.0.1 netmask 255.255.255.255 0 0 static (inside,outside) x.y.z.243 10.3.0.2 netmask 255.255.255.255 0 0 static (inside,outside) x.y.z.240 10.3.0.5 netmask 255.255.255.255 0 0 access-group outside_in in interface outside route outside 0.0.0.0 0.0.0.0 128.187.147.129 1 timeout xlate 0:05:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute aaa-server TACACS+ protocol tacacs+ aaa-server RADIUS protocol radius aaa-server LOCAL protocol local http server enable http 10.3.0.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server community public no snmp-server enable traps floodguard enable sysopt connection permit-ipsec sysopt connection permit-pptp sysopt connection permit-l2tp crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac isakmp enable outside telnet 10.3.0.0 255.255.255.0 inside telnet timeout 5 ssh 10.3.0.0 255.255.255.0 inside ssh timeout 5 console timeout 0 dhcpd address 10.3.0.50-10.3.0.81 inside dhcpd dns 10.3.0.1 dhcpd lease 3600 dhcpd ping_timeout 750 dhcpd domain lindy.local dhcpd auto_config outside dhcpd enable inside username Craig password xxx encrypted privilege 15 terminal width 80 Cryptochecksum:xxx : end mote#
CPU is nearly idle and memory usage is 11meg of 16installed
Any help is really appreciated. Thanks, Craig |
|
|
aryoba
MVM
2004-Jul-14 9:47 am
How did you get those numbers?Exactly how did you get the number 130KBps, 40-50KBps, and 1.4MBps? You might not get the correct one though. |
|
|
to cjlindstrom
Re: Slow PIX 501If you don't mind me asking, what is connected to each interface? A router, switch, PC?
I noticed you had set your speed and duplex settings manually on the PIX, always a good idea, but is the other device configured the same way? On the device interface, assuming a router or switch, are you seeing collisions or possibly FCS alignment errors? If so, this could indicate a duplex mismatch on the connection.
All devices in your network should be manually coded for the correct speed and duplex. Unfortunately auto-negotiation, even between two Cisco devices, is unreliable and not longterm stable. |
|
|
to aryoba
Re: How did you get those numbers?I basically downloaded the oracle 8i client from oracle. And looked at the ie reported rate. Though it may not be exactly accurate, the difference is so dramatic that it is easily observable. |
|
cjlindstrom |
to dwolfenb
Re: Slow PIX 501Both external interfaces (for pix and linksys) are connected to a dlink switch which connects to the campus net (2924s). The inside computers are connected directly to the pix or linksys built in switch respectively. The dlink switch seems to work fine. I have my ip phone, both firewalls and and external interface to a couple of servers on it. I want to put the servers behind the PIX but the PIX it to slow. |
|
jdmatl join:2000-04-27 Deerfield Beach, FL |
to cjlindstrom
Set your External interface to "auto" see what happens. I agree with the others sounds like a duplex mis-match problem.
Ah, now I read the words "DStink" switch. I have a di-624 at home. DStink claims it has 10/100 4port switch. I tried forcing my workstation port to 100 full-duplex... connection dropped.
It isn't possible on the di-624 RevB I have to force the speed and duplex on the nic when connected to the di-624. |
|
|
AFAIK you can't change e1 it is tied directly to the internal 4 port switch. When I force my desktop to full100 it has the same results. The dlink is on the e0 side and I don't think it is the problem since it behaved the same when I tried an IBM managed switch. |
|
cjlindstrom |
New 501 have 100bT on WAN portI was just looking at cisco's site and they say the PIX 501 has a 10/100 the WAN port. Its this true? Mine has a 10baseT, though it is quite old. |
|
|
It looks like you are running code 6.3 and that is all you need to bump your interface to 100bt full duplex. Though all my pix's that I have upgraded with them being connected to Cisco 3550 switches I can't get them to reliably run at 100bt full duplex on the 501's. |
|
jdmatl join:2000-04-27 Deerfield Beach, FL |
to cjlindstrom
Re: Slow PIX 501said by cjlindstrom: AFAIK you can't change e1 it is tied directly to the internal 4 port switch. When I force my desktop to full100 it has the same results. The dlink is on the e0 side and I don't think it is the problem since it behaved the same when I tried an IBM managed switch.
We are talking about the External interface of the Pix, correct? Set the External Pix ethernet interface to AUTO and see what happens? Did the speed get worse, better or same? |
|
|
|
Well imagine that, I had no idea that I could set it to 100full with just the software update. Silly me. That seemed to do the trick. At 10baseT I was still not getting nearly the speed I should have. Thanks for everyone's help! |
|
csbadboyzCsbadboyz Premium Member join:2003-11-14 Sanford, FL |
We have a 501, and I have it set to full100.
so yes the new ios supports that. not sure if the h/w supports it if yours is older. |
|