[cisco-nas] Problem

[Bill Edwards]

Okay, here's the current scenario as I see it:

We have a number of users who have issues getting to certain hosts on the
Internet from sas1 (Cisco AS5200). The network path for such users goes

modem > sas1 > spen-gw-0 > Internet

Users can be pinged from both the Spencer local network and elsewhere on the
Internet. We have replaced sas1 with a spare AS5200 with a copied
configuration from the original AS5200. The border router (spen-gw-0) is a
Cisco 2621 router with a basic configuration and no special packet filtering
other than MS RPC blocks due to recent worm infestations. Watching the
packet
activity pass back and forth between dialin users and hosts such as
www.yahoo.com and www.ebay.com with 'tcpdump' on a UNIX host on the same hub
on the Spencer network as the dialin server and the router shows the dialup
user never ACKing packets from some hosts, but interacting fine with
others. There is a second RAS at this POP, a Cyclades box with 2 PRIs where
this behavior does NOT happen. Another important note is that the AS5200
once
acted as the site's border router as well a dialin server. This was split a
few weeks ago as a way to decrease the load on the AS5200 for filtering
during worm attacks. Configurations are available upon request from both the
router and the AS5200. Thank you in advance for any help you could give us.

William L. Edwards
President/CEO
RNet Incorporated
765-342-3554
wedwards at rnetinc.net