Hi folks
I have a PIX 515e with a DMZ. On the DMZ is a single host that is monitoring the health of servers at remote sites. The remote agents talk HTTPS to this host, so all comms are originated from OUTSIDE.
The trouble started on Monday when a single remote server went dark, i.e., no communication to the host on the DMZ. All other agents at other sites work fine. The logs tell me that the external agent never receives a SYN ACK from the DMZ host. The timeout is only 30 seconds rather than the 2 minutes that I normally see. I then see a SYN ACK attempt by the DMZ host about 20 seconds later, which is dropped because the TCP connection has already been torn down.
So, how do I get the TCP handshake timeout to a higher value, say 2 minutes?
Here are three examples grouped by connection:
15:45:36 302013 xxx.xxx.xxx.xxx 10.12.12.12 Built inbound TCP connection 1101573 for Outside:xxx.xxx.xxx.xxx/21966 (xxx.xxx.xxx.xxx/21966) to DMZ:10.12.12.12/443 (216.107.192.124/443)
15:46:06 302014 xxx.xxx.xxx.xxx 10.12.12.12 Teardown TCP connection 1101573 for Outside:xxx.xxx.xxx.xxx/21966 to DMZ:10.12.12.12/443 duration 0:00:30 bytes 0 SYN Timeout
15:46:22 106015 10.12.12.12 xxx.xxx.xxx.xxx Deny TCP (no connection) from 10.12.12.12/443 to xxx.xxx.xxx.xxx/21966 flags SYN ACK on interface DMZ
15:45:57 302013 xxx.xxx.xxx.xxx 10.12.12.12 Built inbound TCP connection 1101826 for Outside:xxx.xxx.xxx.xxx/21971 (xxx.xxx.xxx.xxx/21971) to DMZ:10.12.12.12/443 (216.107.192.124/443)
15:46:27 302014 xxx.xxx.xxx.xxx 10.12.12.12 Teardown TCP connection 1101826 for Outside:xxx.xxx.xxx.xxx/21971 to DMZ:10.12.12.12/443 duration 0:00:30 bytes 0 SYN Timeout
15:46:43 106015 10.12.12.12 xxx.xxx.xxx.xxx Deny TCP (no connection) from 10.12.12.12/443 to xxx.xxx.xxx.xxx/21971 flags SYN ACK on interface DMZ
15:45:57 302013 xxx.xxx.xxx.xxx 10.12.12.12 Built inbound TCP connection 1101827 for Outside:xxx.xxx.xxx.xxx/21972 (xxx.xxx.xxx.xxx/21972) to DMZ:10.12.12.12/443 (216.107.192.124/443)
15:46:27 302014 xxx.xxx.xxx.xxx 10.12.12.12 Teardown TCP connection 1101827 for Outside:xxx.xxx.xxx.xxx/21972 to DMZ:10.12.12.12/443 duration 0:00:30 bytes 0 SYN Timeout
15:46:44 106015 10.12.12.12 xxx.xxx.xxx.xxx Deny TCP (no connection) from 10.12.12.12/443 to xxx.xxx.xxx.xxx/21972 flags SYN ACK on interface DMZ
Here are the config parts related to timeouts:
PIX 7.2(2)
arp timeout 14400
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
telnet timeout 5
ssh timeout 60
console timeout 0
Thanks
William Daugherty