I'm trying to troubleshoot a configuration that I inherited and I'm not 
sure where to start.

We have a retail client with three stores each with a PIX 501 connected 
via site to site IPsec tunnels to an ASA 5520 at a central location.  
Workstations at each store telnet to a Linux server at the central 
location.

For the past couple of weeks, the telnet connections at the store have 
been intermittently disconnecting.  It seems to be happening maybe 3-4 
times a day overall.

I don't see any errors on the firewalls logs or interfaces or on the 
network interface of the Linux server.

Any ideas on how I should troubleshoot this issue?

Thanks in advance!
  -- Vince

Do you have some configs we can see?

"Vince Kimball" <vince@vkimball.com> wrote in message 
news:MPG.218c53102bd3ef90989680@newsgroups.comcast.net...
> I'm trying to troubleshoot a configuration that I inherited and I'm not
> sure where to start.
>
> We have a retail client with three stores each with a PIX 501 connected
> via site to site IPsec tunnels to an ASA 5520 at a central location.
> Workstations at each store telnet to a Linux server at the central
> location.
>
> For the past couple of weeks, the telnet connections at the store have
> been intermittently disconnecting.  It seems to be happening maybe 3-4
> times a day overall.
>
> I don't see any errors on the firewalls logs or interfaces or on the
> network interface of the Linux server.
>
> Any ideas on how I should troubleshoot this issue?
>
> Thanks in advance!
>  -- Vince 

When the connection from linux disconnect does IPsec also disconnect
from the peer.

How many workstations at each store ?

The PIX 501 by default only has 10 user license so it will not support
more than 10 sessions

In article <1193559213.830128.10800@50g2000hsm.googlegroups.com>, 
chetan.kamra@gmail.com says...
> When the connection from linux disconnect does IPsec also disconnect
> from the peer.
> 
> 

No, the IPsec doesn't disconnect.  Other telnet sessions from the same 
location aren't dropped just one.

In article <1193568773.538895.221550@y42g2000hsy.googlegroups.com>, 
merv.hrabi@rogers.com says...
> 
> How many workstations at each store ?
> 
> The PIX 501 by default only has 10 user license so it will not support
> more than 10 sessions
> 
> 

Two of the stores have PIXes with 50 user licenses.  Those stores have 
between 5 and 10 workstations.

One store only has 2 workstations so they have a 10 user license.

It doesn't seem to be a user license issue, as the dropped user can 
immediately reconnect.

Assuming it is not an IPSEC issue, then I would put a sniffer ( PC
with Etherreal) and capture the Telnet sessions to the Linux server.

When an incident occurs is it all of the workstations in a store that
disconnect or just some?

Are all stores affected at the same time?.

Assuming it is not an IPSEC issue, then I would connect a sniffer ( PC
with Etherreal) on the same LAN where the Linux server and capture the
Telnet sessions to the Linux server.  Look for TCP resets and the like.

In article <1193649986.123670.192680@d55g2000hsg.googlegroups.com>, 
merv.hrabi@rogers.com says...
> 
> Assuming it is not an IPSEC issue, then I would put a sniffer ( PC
> with Etherreal) and capture the Telnet sessions to the Linux server.
> 
> When an incident occurs is it all of the workstations in a store that
> disconnect or just some?
> 
> Are all stores affected at the same time?.
> 
> Assuming it is not an IPSEC issue, then I would connect a sniffer ( PC
> with Etherreal) on the same LAN where the Linux server and capture the
> Telnet sessions to the Linux server.  Look for TCP resets and the like.
> 
> 

Generally it's just a couple of workstations at a time, not all 
workstations at a store nor all stores.

On Oct 29, 6:03 am, Vince Kimball <vi...@vkimball.com> wrote:
> In article <1193649986.123670.192...@d55g2000hsg.googlegroups.com>,
> merv.hr...@rogers.com says...
>
>
>
> > Assuming it is not an IPSEC issue, then I would put a sniffer ( PC
> > with Etherreal) and capture the Telnet sessions to the Linux server.
>
> > When an incident occurs is it all of the workstations in a store that
> > disconnect or just some?
>
> > Are all stores affected at the same time?.
>
> > Assuming it is not an IPSEC issue, then I would connect a sniffer ( PC
> > with Etherreal) on the same LAN where the Linux server and capture the
> > Telnet sessions to the Linux server.  Look for TCP resets and the like.
>
> Generally it's just a couple of workstations at a time, not all
> workstations at a store nor all stores.

The few workstations at a time - are they at one store or multiple
stores - if they are at multiple stores then it may indicate that the
issue is a the central site.