Pix is resetting inbound connections (Reset-I)

I have a webserver behind my Pix 501 that I'm trying to make a
connection to from the outside. Every time I attempt a connection the
Pix logs the error 302014 and resets the connection.

%PIX-6-302014: Teardown TCP connection number for
interface_name:real_address/real_port to
interface_name:real_address/real_port
duration time bytes number [reason] [(user)]

Reason= Reset-I in my logs

I cannot get this to work. Below is my pix config. The webserver
address is 192.168.1.3. The rest you can see in my config.

PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password MYPASSWORD encrypted
passwd MYPASSWORD encrypted
hostname MYPIX
domain-name MYDOMAIN
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol http 81
fixup protocol ils 389
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
access-list 130 permit tcp any host interface outside eq 81
access-list 130 deny ip any any log
pager lines 24
logging on
logging trap informational
logging host inside 192.168.1.5 6/1470
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.1.1 255.255.255.128
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface 81 192.168.1.3 81 netmask
255.255.255.255
0 0
access-group 130 in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80

I think I have my static command set up correctly. And my access-list
should allow the traffic through. My concern is that this config
cannot be done with my outside interface set to dhcpc.

Any help would be great because I've been stuck on this for days!

 

:I have a webserver behind my Pix 501 that I'm trying to make a
:connection to from the outside. Every time I attempt a connection the
ix logs the error 302014 and resets the connection.

:%PIX-6-302014: Teardown TCP connection number for
:interface_name:real_address/real_port to
:interface_name:real_address/real_port
:duration time bytes number [reason] [(user)]

:Reason= Reset-I in my logs

Does the content get delivered? If so then the problem has to do with
the logging, not with the config. PIX 6.3(3) tends to record Reset-I
when the inside system sends a reset before the FIN ACK has made its
way back from the outside. It -should- have a longer timer to clean
up packets in transit, but for whatever reason, it doesn't.

It gets disconcerting when one starts seeing denied inbound connections
sourced from port 80 of a remote machine, when the problem is really
the logging, that it has just closed down a connection -to- port 80
of the remote machine and is clearing out its connection tables too soon.

 

Hey Walter,

The content does not get delivered. I checked my xlates and there are
none for the connection and my apache logs don't show any requests. I
wouldn't be worried about the logging if the connection worked.
Here's a little more of the puzzle. I ran network monitor on a
machine attempting to contact the webserver and it recorded:

Syn packet sent to the outside interface of the pix on port 81 and
then a rst packet back from the pix to the host attempting the
connection.

So it looks like the pix is really just killing the connection for a
reason I can't figure out. It's not just a log entry. At first I
thought it might be the IDS, but I don't have it set up to reset
connections, matter of fact it's not enabled at all.

Any other ideas? I'm almot out of them!

Thanks again

 

Am I missing something here or......

The PIX logged a Teardown, so it must have let the packet through. If it
was blcoking it, you would have a 'deny' in the log.

The PIX tore the connection down because the inside (your web server)
sent back a RST packet.

Does you web server work? Telnet to localhost on port 81 from the
console of your web server. Maybe it isn't running?

Just a guess.

 

Do you reckon this has been fixed in 6.3(4) as I'm not seeing any of the
ACL denies I used to on my home PIX 501?

Cheers,

Matt