Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are currently using a Cisco ASA 5510 with a CSC SSM module for our firewall. When trying to get to a certain site, we get a "503 Service Unavailable - Unable to connect to IP" error. If I connect a laptop outside the ASA I am able to reach the site without an issue. I've completely disabled all Web scanning/blocking, and the problem persists.

DNS info seems to be fine, as nslookup shows the same IP address whether I'm behind the ASA or not. Ran "wget" from a Linux server and get the same result. It shows that it connects to the site, then says "Waiting for response". After about a minute or so it gets the 503 error.

We've had minor issues occasionally with getting 503 errors on sites since installing the ASA, but usually refreshing the page fixed it every time. With this particular site we get the 503 error every time.

share|improve this question
1  
I wonder if this story gets you moving in the right direction packetpushers.net/revenge-of-the-toe –  SpacemanSpiff Nov 19 '12 at 20:38
    
Thanks for the info. That seems to be a web server side issue, unfortunately. We don't even have the TTL protection set up on our ASA. As for the TOE part of that article, I talked to my manager (who is working with the web hosting company) to see if we can get that disabled. Not sure if we can or not yet. I even took the CSC SSM module out of the picture (running straight through the ASA now) and now I don't even get the 503 error, just "The connection was reset" when going to the page. All other pages still work fine. –  user146153 Nov 20 '12 at 17:25
    
How is the ASA implemented? L3 mode? Transparent mode? Is it performing NAT? –  SpacemanSpiff Nov 20 '12 at 21:15
    
The ASA is in Routed mode. It is performing NAT, as well. It's mostly at the default config aside from management SSH config, some ACL's, and policy maps set up to send traffic to the CSC SSM. Currently all HTTP/HTTPS scanning has been disabled on the SSM(we weren't using it to do much anyways, just block some domains that were known to host malware). –  user146153 Nov 21 '12 at 12:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.