Newsgroup: it.comp.reti.cisco
Titolo: Pix - blocco NAT

Ciao a tutti,
da un po' riscontro un grave problema sui flussi di dati e sul relativo
blocco di alcune funzionalità del PIX tra le quali il NAT.
Ogni circa venti giorni ho necessità di fare un reload perchè il
traffico tra le interfacce risulta essere nullo. I log vengono
esportati su server lan e dando un'occhiata ai processi sembrerebbe che
il buon vecchio 557poll occupi un bel po' di memoria, ma non credo
dipenda da quello...
Vi posto la cfg:
-----------------------------------------------------
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 DMZ security4
enable password ************************ encrypted
passwd *************************encrypted
hostname ***************************
domain-name *************************
clock timezone GMT+1 1
clock summer-time summert recurring last Sun Mar 2:00 last Sun Oct 3:00
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
object-group network server_web
  description web server
  object-group network mail_server
  description Server Mail
  object-group network dns_server
object-group network relayer
  description front-end relayer
****
ACLs
****
pager lines 24
logging on
logging timestamp
logging monitor informational
logging buffered errors
logging trap warnings
logging host inside *********/1468
mtu outside 1500
mtu inside 1500
mtu DMZ 1500
ip address outside **************** 255.255.255.0
ip address inside ***************** 255.255.255.0
no ip address DMZ
ip audit info action alarm
ip audit attack action alarm
ip local pool vpn_pool 192.168.32.1-192.168.32.254
pdm location 192.168.25.0 255.255.255.0 inside
pdm location 0.0.0.0 0.0.0.0 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) ****************** 192.168.25.40 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.20 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.150 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.151 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.152 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.153 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.21 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.22 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.50 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.30 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.70 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.41 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.10 netmask
255.255.255.255 0 0
static (inside,outside) ******************192.168.25.154 netmask
255.255.255.255 0 0
access-group FW_in in interface outside
route outside 0.0.0.0 0.0.0.0 ****************** 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
ntp server 193.204.114.105 source outside
http server enable
http 0.0.0.0 0.0.0.0 outside
http 192.168.25.0 255.255.255.0 inside
snmp-server host inside 192.168.25.150
snmp-server location ****************** datacenter
snmp-server contact ******************
snmp-server community ******************
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address
outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map client authentication LOCAL
crypto map outside_map interface outside
isakmp enable outside
isakmp identity address
isakmp nat-traversal 20
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
vpngroup ******************_vpn address-pool vpn_pool
vpngroup ******************_vpn dns-server 194.20.8.4
vpngroup ******************_vpn default-domain 
telemacus.net
vpngroup ******************_vpn split-tunnel 101
vpngroup ******************_vpn idle-time 7200
vpngroup ******************_vpn password ********
telnet 192.168.25.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 192.168.25.0 255.255.255.0 inside
ssh timeout 60
console timeout 0
username******************encrypted privilege 2
username ******************encrypted privilege 15
terminal width 80
banner login ****************** PIX 515E is Ready. Any access not
athorized is forbidden!
Cryptochecksum:******************
: end
******************PIX#
-----------------------------------------------------
A qualcuno di voi viene in mente qualcosa? Altri PIX su gateway
differenti non riscontrano problemi sull'utilizzo nel tempo... questo
invece richiede un restart per riprendere operatività.
La cosa strana è che l'accesso VPN funziona perfettamente, sembra non
esegua NAT.
Ciao a tutti e grazie!!
Paolo

 PIX Version 6.3(4)
Cisco ha rilasciato la 6.3(5), scaricabile gratuitamente, perché risolve un bel po' di problemi. Se 
non è un problema puoi fare l'update.
HTH Alex.

Ciao Alex,
grazie per avermi risposto, un baco della versione del PIX mi era
venuto in mente, tu me ne dai conferma. A buon rendere!!
Paolo
AM ha scritto:
