This is from PIX documentation but will still apply. The issue is not
specific to any one platform. Not sure if you need a CCO account to view
this.
Hope this helps...
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note
09186a008009491c.shtml
Reverse DNS Lookups
If you are experiencing slow performance with the PIX, verify that you
have Domain Name System Pointer (DNS PTR) records (also called Reverse
DNS Lookup records) in the authoritative DNS server for the external
addresses that the PIX is using. This includes any address in your
global Network Address Translation (NAT) pool (or the PIX's outside
interface, if you are overloading on the interface); any static
addresses; and internal addresses (if you are not using NAT with them).
Some applications, such as File Transfer Protocol (FTP) and Telnet
servers, may do Reverse DNS lookups to try and determine where the user
is coming from and if it is a valid host. If the Reverse DNS lookup does
not resolve, then performance will be degraded as the request times out.
To ensure that a PTR record exists for these hosts, issue the nslookup
command from your PC or UNIX box, followed by the global IP address you
are using when you connect to the Internet.
Example
% nslookup 198.133.219.25
25.219.133.198.in-addr.arpa name = www.cisco.com.
You should receive a response back with the DNS name of the device
assigned to that IP address. If you do not receive a response back,
contact the person that controls your DNS to request the addition of PTR
records for each of your global IP addresses. For more information about
performance issues on the PIX caused by missing PTR records, see Poor or
Intermittent FTP/HTTP Performance Through a PIX
<http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_not
e09186a0080094459.shtml> .
-----Original Message-----
From: Dan Tesch [mailto:dan.tesch@comcast.net]
Sent: Thursday, October 21, 2004 11:36 PM
To: firewalls@securityfocus.com
Subject: Cisco CBAC
Since starting to work with a new company which is using
a Cisco 2611 router with firewall IOS, I have noticed too many
times problems with downloading from certain FTP sites,
some won't work at all - problems downloading from websites
and applications used from vendor websites having problems.
As I have studied CBAC and come to understand what it does,
I am starting to wonder if this could be causing some of the
problems - Has anyone else had similar experiences? why
does a Cisco router with this feature work differently than a
standard NAT router?
Thanks
