[c-nsp] FWSM v2.3.3 NAT issue

[Nicolas FISCHBACH]

Brett Looney wrote:
>
> Yup, but we didn't see anything in there that was going to be a 
> problem for us - apart from the ones that appear to crash the FWSM 
> but there isn't enough information in the release notes to say when 
> that occurs.
> 
> As an update, the TAC have confirmed that our problem is a new bug 
> and they're checking 2.3.2 to see if it exists there, but rolling 
> back isn't an easy option for us - we're exploring other (non-FWSM 
> based) solutions. We don't have a workaround or an ETA on a fix yet.

Sorry about the TAC-like answer, but did you give 2.3.3-INTERIM a try ?
They have fixed quite a number of bugs since the release of 2.3.3.

  FWSM Firewall Version 2.3(3)2 <system>
  Compiled on Fri 21-Oct-05 16:11 by dalecki

In the last bugscrub (~1 month old) for 2.3.3 that I have there are no
entries that could be related and marked as "DDTS not fixed", maybe
you've found a new bug.

We've seen such a weird behaviour +/-1 year ago, probably on a 2.2.x
release, but it was due to the use of shared VLANs between contexts
mixed with cascading contexts (and same-security-level interfaces), so
not really related.

Nico.
-- 
Nicolas FISCHBACH (nico at securite.org) <http://www.securite.org/nico/>
Senior Manager - IP Engineering/Security - COLT Telecom
Securite.Org Team - http://www.securite.org/