When trying to download files with FTP or access external sites on the
worldwide web from behind the PIX Firewall, network users may experience poor
or intermittent performance. This can occur because host IP addresses in the
global pool (or internal host IP addresses, if you are using Network Address
Translation [NAT] 0) are not properly registered in the Domain Name System
There are no specific prerequisites for this document.
This document is not restricted to specific software and hardware
For more information on document conventions, see the
Technical Tips Conventions.
Some symptoms of poor performance include the following.
A user can connect to an FTP site, but cannot execute any commands
(such as LS, PUT, or
FTP performance is extremely slow.
File transfers being performed using FTP will reach only n%, at which
point the transfer will halt without being completed.
A user may not be able to access certain web
Note: These symptoms may also be caused by the
Use nslookup to resolve a random number from
your global pool. If you are using NAT 0, try to resolve your actual host IP
addresses. The error message No host/domain
usually indicates a lack of reverse DNS entries. If you do successfully resolve
to a name, please refer to
Performance Issues Caused by IDENT Protocol (Port 113).
In PIX software versions earlier than 4.2.x, syslog at 20.7 may show
deny messages, even though the hosts in question
are not being blocked by access lists, authentication, license count, and so
on. In PIX software versions 4.2.x or later, the logging facility
20 and logging trap debugging commands
may show similar deny messages.
In the primary DNS for the domain, make sure there is a
(PTR) record for each IP address, either those in a global pool or the
ones that pass through via NAT 0. (These records are also known as
Once PTR records have been entered, an
nslookup run on an IP address should resolve to a