Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

So our client is using a Cisco ASA and they are having occasional "Page cannot be displayed" errors. We have determined through lots of troubleshooting that our firewall doesn't like the ASA reusing port numbers within ~2-4 minutes time with a sequence number that is lower.

We know you can change the ASA to not randomize sequence numbers but is it possible to have the ASA not use the same port within a certain amount of time?

Note: We are working with our Firewall Vendor to see if we can get around it on our end instead of theirs.

Thanks, - Vince

share|improve this question
If you have additional Internet facing IPs, have you considered adding additional IPs to the NAT pool? – user48838 Jun 29 '11 at 14:52
What model ASA? Have you checked the connection count on the asa when it happens (sh conn)? – HampusLi Jun 30 '11 at 8:49
We do have a number of IPs but the only way that changes things is if we make our client use multiple IPs right? Which isn't fun to do. Unless you have a different idea... – VinceM Jul 1 '11 at 12:25
HampusLi - I'm not sure the model of ASA since it's our client's. They are a big enough company that I wouldn't be able to tinker with their firewall. I could pass on the info to their guys, which would probably take 2 years to get any info back. – VinceM Jul 1 '11 at 12:27

1 Answer

up vote 0 down vote

You'd be better allowing/keeping the port randomisation otherwise you could fall into a sequence number attack based on mitm etc. Not good. Are you using a strange firewall your send? I've never seen anything like this on webservices with ASA on the front door.

share|improve this answer
Yeah I did see that that was a risk. Our firewall is made by Watchguard. We probably wouldn't want to ask our client to modify their firewall to turn off port/sequence number randomization. It would be better if we can force the ASA to not re-use port numbers within a few minutes. – VinceM Jul 1 '11 at 12:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.