Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a very odd issue with our cisco firewall,

If on our osx machines we run the following to disable window scaling support:

sudo sysctl -w net.inet.tcp.rfc1323=0

We see near 40% improvement in download speeds (tested using varying linux iso image mirrors).

If I sit my machine directly onto the outside modem (Manually setting up an external ip adress within the range etc), the bandwidth remains constant with rfc1323 enabled and disabled, so it has to be the cisco.

Something else to note:

  • None of our linux devices suffer this problem

Has anyone come across this issue before? I seem to find some vague references in old mailing lists detailing PIX workarounds which are no longer applicable to cisco ios.

Thanks in advance.

share|improve this question
    
What version FOS are you running? –  Paul Ackerman Dec 2 '11 at 15:10
    
Are you blocking inbound ICMP in the firewall? Can you do a tcpdump to figure out what's different between the two connections? –  Shane Madden Dec 2 '11 at 18:52
    
@ShaneMadden I am blocking ICMP –  Oneiroi Dec 5 '11 at 11:15
    
@PaulAckerman ASA Version 8.2(1) –  Oneiroi Dec 5 '11 at 11:16
    
I am running 8.3 and cannot replicate this problem. although I did find this in the release notes for 8.3: CSCsz11180 TCP Proxy mis-calculates TCP window causing connectivity problems. Perhaps you could upgrade and see if the problem remains? –  Paul Ackerman Dec 5 '11 at 20:27
show 1 more comment

1 Answer

up vote 1 down vote accepted

I am running 8.3 and cannot replicate this problem. although I did find this in the release notes for 8.3: "CSCsz11180 TCP Proxy mis-calculates TCP window causing connectivity problems." Perhaps you could upgrade and see if the problem remains?

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.