Http Traffic Slow/Broken, ping fine

Hello,
I am writing because as of this morning all http traffic on my network has went to a snails pace. However, pings of all types work at normal speed, but fail approximately 5% of the time(Independent of pinging internal address or external).
I have a very basic setup, i do not really have any custom configures on anything. The only wifi authentication at the moment is WPA2-PSK. I have this network set up as a test bed for a new setup, its a good thing too because it is unusuable in its current state.
Network Setup:
3 3502i AP - Setup in Hreap mode - Connected to PoE Switch
1 2106 WLAN Controller - Connected to 2960
2960s Switch
Dell Layer 2 PoE Switch
Thanks!
Seth

Since you are using HREAP, I'd sniff the AP port. Make sure the traffic is flowing in both direcitons there before going further. You should also make sure to prune the VLAN that are not needed on the AP.
Also, make sure your ports are full duplex and not at half.

Similar Messages

Internet Connection sharing and HTTP traffic

Hello anyone,
I have a late 2009 iMac and a late 2008 MacBook Air. I connect to the internet via a ADSL PPPoE modem, which is connected to the iMac via ethernet. I've set up the iMac to share the ADSL connection via AirPort to the MacBook Air, with WEP protection (it's either WEP or no protection at all, so I have to stick with it). Before the OS X Lion upgrade, everything worked fine (the iMac used Snow Leopard and the MacBook used Leopard). Now I have upgraded both comptuers to Lion: the iMac works flawlessly, but the MacBook Air is unable to get HTTP traffic from the iMac. IMAP, Skype, ICMP, XMPP and other protocols works fine but HTTP has some problems. First of all, I can get some web pages (either via a browser or curl), like Google and Google-owned sites (YouTube, Orkut, Blogger...), Macworld.com and some Italian sites, but if I try other sites, all I get is the browser to load something forever. If I ping these sites, they reply normally. If I try to get (for instance), Yahoo's homepage with curl all I get is a blank file (and curl shows that 0 bytes were transmitted/recieved). This problem is shown with every device I use via Wi-Fi, such as iPod touch, iPhone and another MacBook (with Snow Leopard on).
So I guess there's some problem in iMac's Conncetion Sharing... has anyone a suggestion?
Thanks
Simone

I no nothing about Windows. Nothing.
But to configure your Mac to share an ehternet to wi-fi connect follow these steps;
My Mac mini is connected to the internet by Ethernet cable to my ISP's Arris gateway. I am sharing the Ethernet connection to two iPod Touches, an iPhone and now an iPad 2 over AirPort from my Mac mini.
1. In Sys Prefs/Sharing I highlighted Internet Sharing (do not check the box)
2. Share your connection from: Ethernet (from the dropdown menu)
3. To computers using: AirPort (check the little box)
4. Press the button AirPort Options...
5. Name your Network
6. I use Automatic for the channel
7. I encrypt my network using a 40-bit WEP key
8. For a non-Apple device, like a Windows laptop or an XBox, you must use only a 5 alphanumeric character, 40-bit WEP password or only a 13 alphanumeric character, 128-bit WEP password
9. Press OK
10. Check the box for Internet Sharing
11. Answer any dialog boxes that pop up
Dah•veed

An HNAP call to the device failed because the HTTP connection was broken - EA3500

OK - thanks in advance for your help -
I have a linksys Linksys WMP300 and am able to connect to the EA3500 (shows connected at 270 Mbps) Excellent Connecttion but I can't access the internet or any of the other computers on my network. The stupid thing is that I can connect to my neighbor's unsecured network which is also a linksys router.
All of the other computers on the network connected just fine - my son has a laptop running windows Vista, we have a family computer using Vista, my wife's laptop is Windows 7 (we just had a guest that connected just fine).
Here's the error code I get - any help would be appreciated!
Error code: 82BD0304
Error description: An HNAP call to the device failed because the HTTP connection was broken.
Model name: unknown
Model number: EA3500
Serial number: 12C10603215584
Firmware version: unknown
Operating system: Windows XP SP 3
Software version: 1.4.12005.2
Connection type (WAN): unknown
IP address (LAN): unknown
IP address (WAN): unknown
Computer IP address: 192.168.1.36

Thank you for the reply -
Router is assigning IP address automatically. Although I have been using a static IP address in the past, this is no longer the case.
The WMP300 is on an Windows XP, SP3 PC.
Since running into this issue, I have not only disabled all security (to make sure that firewalls and/or virus software was causing problems) I completely uninstalled my McAfee. I have disabled Windows Firewall also. "Flying Naked" as it were.
I am surprised that Cisco has no solution - others are also having this problem.
It MUST be the router - I am able to connect to my neighbor's router, able to connect to my old Linksys WRT150N. Anyone else have thoughts?
This is frustrating.

Redirect / Block non https traffic

I have a quick question. Today I setup teaming 2.0 on SLES10.
After customizing the SuSE firewall per the instructions everything is perfect. I then cut off non-secure port 80 traffic. Looked OK. I found that the email that teaming sends out is http://server, since I killed http traffic it's now broken. I tried changing the firewall rule to FW_REDIRECT="0/0,10.0.100.100,tcp,80,8443 to see if it would just redirect the port 80 traffic to 8443 on the server - but that did not work. Is their a place I can simply change the email to link to https://server?
Any other thoughts?
Cool product by the way!
Tha
Dennis

Dennis,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

WSA blocking HTTPS traffic -allowing HTTP

We have two S170 WSA appliances configured as Guest Wi-Fi Internet proxy servers. The local network design is as follows:
WLC5508 (Foreign) >> WLC5508 (Anchor) >> ACE20 Context >> WSA 170 >> FWSM >> Internet
Guest traffic is authenticated via WCS using RADIUS but is disabled for now.
Clients associate to SSID, receive IP address via local DHCP scope on anchor WLC and forward all traffic to DFWG which is ACE20 interface.
ACE20 has specific class-maps for public DNS use and loadbalance policy-map which forwards all other traffic (excluding DNS) to WSA.
HTTP traffic works fine, HTTPS traffic fails. The HTTPS proxy service uses a local self-signed certificate for initial decryption of the session. The browser and WSA negotiates to use TLSv1 then the error below is shown.
Fails
57666018.658 32 192.168.244.1 NONE_SSL/200 0 TCP_CONNECT 10.153.9.6:443 - NONE/- - OTHER-NONE-NONE-NONE-NONE-NONE-NONE <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",0.00,0,-,"-","-"> - s-ip= 255.255.255.255 s-port= 443 webcat-code= - cs-version= 0 cs-auth-group= - c-port= 54930 cs-bytes= 0 wbrs-score= - wbrs-threat-reason= - wbrs-threat-type= - cs-user-agent= - cs-referer= - cs-cookie= -
1357666018.760 32 192.168.244.1 NONE_SSL/200 0 TCP_CONNECT 10.153.9.6:443 - NONE/- - OTHER-NONE-NONE-NONE-NONE-NONE-NONE <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",0.00,0,-,"-","-"> - s-ip= 255.255.255.255 s-port= 443 webcat-code= - cs-version= 0 cs-auth-group= - c-port= 54931 cs-bytes= 0 wbrs-score= - wbrs-threat-reason= - wbrs-threat-type= - cs-user-agent= - cs-referer= - cs-cookie= -
1357666018.799 0 192.168.244.1 TCP_DENIED_SSL/403 0 GET https://post.packetconsulting.com:443/owa - NONE/- - BLOCK_ADMIN-HTTPS-NonLocalDestination-NONE-NONE-NONE-NONE-NONE-NONE <-,-,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,-,-,"-","-","-","-","-","-",0.00,0,-,"-","-"> - s-ip= 255.255.255.255 s-port= 443 webcat-code= - cs-version= 1 cs-auth-group= - c-port= 54931 cs-bytes= 598 wbrs-score= - wbrs-threat-reason= - wbrs-threat-type= - cs-user-agent= "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; GTB7.4; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET CLR 1.1.4322; InfoPath.2; Tablet PC 2.0; MS-RTC LM 8)" cs-referer= - cs-cookie= -
I have seen this error posted before but no resolution. I'm sure this is a config problem, but cannot figure why or where!
Any ideas, thoughts or help would be great...
Cheers

Hi axa,
This is an access policy blocking the SSL traffic based on the TCP_DENIED_SSL / 403. Also I would suspect that you do not have HTTPS proxy enabled which would be required since your not using port 80 for 443 traffic. I would recommend opening a ticket with the WSA Content Security Team.
Sincerely,
Erik Kaiser
WSA CSE
WSA Cisco Forums Moderator
Message was edited by: Erik Kaiser

Ironport not forwarding HTTPS traffic

We have recently been trying to setup a BYOD wireless network and the wireless Clients that join this network have their traffic routed directly to an Ironport S370 (Ver7.1.4-053) as we do not want the BYOD users to have to configure their proxy settings.
We have created an Identity which matches the Subnet given to BYOD devices with no authentication and then an Access Policy for filtering, all this works as long as the traffic is HTTP, as soon as you try to access anything using HTTPS then the Ironport seems to drop the traffic as it never hits the firewall and the page cannot be displayed.
Any domained clients which have the Ironport address as their proxy work fine.
The Ironport is not set to bypass any addresses in bypass settings.
I am sure there must be a simple answer as to why HTTPS traffic is not being forwarded and any pointers as to why this is would be gretly appreciated.
Many thanks,
Neil.

Hi Igor and Neil,
As per AsyncOS 7.5 documentation, HTTPS proxy needs to be enabled to process HTTPS traffic in transparent mode.
following is the extract from the doco.
" When the Web Proxy is configured in transparent mode, you must enable the HTTPS Proxy if the appliance receives HTTPS traffic. When the HTTPS Proxy is disabled, the Web Proxy passes through explicit HTTPS connections and it drops transparently redirected HTTPS requests. The access logs contain the CONNECT requests for explicit HTTPS connections, but no entries exist for dropped transparently redirected HTTPS requests "
If you do not want to decrypt HTTPS traffic, you can enable HTTPS proxy in pass-through mode.
Thanks,
Wipula.

RV042 - Priority Routing HTTP Traffic Over WAN2?

Hi,
I have an RV042 set to load balancing. WAN1 is a T1 and WAN2 is an ADSL connection. It seems that more often than not web traffic is going out over the slower WAN1, so I'd like to try to route http traffic over the ADSL before the T1 due to the higher download speed.
Is there a way to do this?
Thanks!

blasty,
Yes it is possible. It is called protocol binding, and the configuration steps for this can be found on page 23 of this guide:
http://www.cisco.com/en/US/docs/routers/csbr/rv042/admin/guide/RV042_V10_UG_C-WEB.pdf
If you have any problems please post them in as much detail as possible.
Bill

Transparent wsa and https traffic

folks
i've deploying a S300V in transparent mode and using wccp
i have a single policy allowing http and https
http works fine but https doesn't
i can see both sets of requests go out through my outer firewalls but the https handshake doesn't get past the client hello
the VM is being used on a guest wifi network so clients won't be authenticated, won't have a common root certificate and i don't want to decrypt traffic
tac are telling me i need to enable the https proxy but i can't as clients won't have the root certificate required
do i need to use https proxy?
thanks to anyone taking the time to reply

Ken,
If I dont to decrypt HTTPS but still want the traffic to be inspected for URL and web reputation, do I need to upload a root certificate still? I would have assume not as I do not want to decrypt HTTPS but the GUI doesn't allow me to enal HTTPS Proxy without uploading a certificate; basically I cannot "Enable HTTPS Proxy" and submit without a cert.
Basically what I just want to do is just pass through the HTTPS traffic to be check against the Access policies that the HTTP is being checked against.
Is this viable? If so can you let me know how I can achieve the above?
Thanks

ISE Guest Portal only redirect HTTPS traffic.

I have a wireless deployment consisting of the following:
5760 WLC & ISE 1.2
Am I missing something here
I have 4 similar deployments, and never had these issues:
On Android / Apple devices, the guest portal does not pop up automatically &
On a Windows Laptop only https traffic directs to the guest portal.
Thanx

i think you need to recheck the configuration also check the link for step by step config
http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-security/landing_DesignZone_TrustSec.html

Is it possible to redirect https traffic to http in CSM?

Hello,
I have a requirement to redirect https traffic to http. Is it possible to do that in the CSM?
In the CSM documentation all redirect examples/config etc refer only to http traffic so I am wondering if the other way around is supported as well.
BTW I have already tried it on the CSM and it is not working. Everytime I try to reach the https url I get "ERROR_INTERNET_SECURITY_CHANNEL_ERROR" on http watch.
Thanks for any help offered.
Murtaza

I don't have a config in hands for this.
I have done it before and know this is feasible.
The redirect is here :
http://www.cisco.com/en/US/products/hw/modules/ps2706/products_configuration_example09186a00802877f6.shtml
Just change the vip to be only accessible by the SSLM.
Create the appropriate redirect vserver.
On the SSLM, send the decrypted traffic to the vip address and port.
Just as if the Vip was a server.
Gilles.

Can a WLC redirect HTTPS traffic in a CWA environment

Hi Guys.
Regarding with ISE, CWA and WLC, I 'm seeing that when you connect to the SSID and open your navigator, if the URL is an HTTPS URL the traffic is not redirected to the ISE Portal using CWA. I though that the WebAuth Proxy Redirection Port option of the WLC only works when It has the portal (LWA) but not in CWA.
I only found information about the redirection of the traffic when is a HTTP connection (port 80).
Is it possible to redirect HTTPS traffic in a CWA deployment??, most of my users use Google Chrome and, in some scenarios, any search using Gooogle is in HTTPS mode and the captive portal is not shown.
Thanks.
Best regards.

No, the WLC is not able to redirect HTTPS pages.
You can however add other ports(other than 80) that can be redirected incase of proxy etc.
HTH,
Steve
Please remember to rate useful posts, and mark questions as answered

How to redirect https traffic to captive portal?

Any WLC controller model (8500/5508/2504/vWLC) version 7.3 and up..
This is unusual scenario wherein clients have a default homepage to https://www.google.com (sample only)
Typical http web redirection don't have any problem at all. When you open your browser and type http://www.google.com it will redirect to captive portal without any problem.
Is there any way to redirect https traffic to captive portal as well?

redirection only happen on http traffic, a feature request has been issued to have the redirection happen on https.
please check the following
CSCar04580
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCar04580
Please make sure to rate correct answers

QoS value for http traffic from IP Phone

Since the phone marks all voice with COS 5 and data traffic with COS 0. Does this also include traffic sourced from the IP Phone http? request when doing Directory Lookups, IP Phone Services.
Thanks!

With 4.1 and up (not sure if 4.0 had this), this traffic is marked with TOS 3 or DSCP CS3 (24). You can modify this enterprise parameter to what ever you want.
DSCP for SCCP Phone-based Services :
This parameter specifies the Differentiated Service Code Point (DSCP) IP classification for IP phone services on SCCP-based phones, including any HTTP traffic. Note: You must restart SCCP-based phones for this parameter change to take effect.
This is a required field.
Default: default DSCP (000000).
Restart SCCP-based phones for the parameter change to take effect.
HTH
Sankar
PS: please remember to rate posts!

Intercepting all http traffic and forwarding to VIP on CSM?

We would like to intercept all http traffic from clients from all vlans and redirect them to a VIP on the CSM for loadbalancing to 2 proxy servers. Is this possible? I can't seem to find a solution similar to our issue? Please help thanks!

Thx Giles! Do you mean a policy that uses route-maps with next-hop? So would I point the next-hop address to the CSM client vlan IP? Do you have a support link that covers this in detail? Thx!

SG300 Redirect HTTP Traffic to Proxy

Dear Cisco Community,
We have the following setup
1 x SG300 Switch in Layer 3 Mode
VLAN 100 (Management VLAN)
VLAN 200 (Data VLAN for Internet Users)
The SG300 has an IP4 Interface in each VLAN:
100: 10.1.1.254 / 24
200: 10.1.2.254 / 24
The internet gateway (Zyxel USG-100) is located in VLAN 100.
In order to restrict the web browsing acitivites, we're in the process of implementing a Proxy server (GFI Webmonitor). Is it possible, to redirect all HTTP and HTTPS traffic which arrives at the SG300's VLAN200 IP interface to the proxy server? I was thinking of a static route, but then this would apply to all traffic. Another option would be to block port 80/443 traffic using an ACL I suppose=
Any input will be highly appreciated, thank you!
Kind regards,
Romeo

Hi Mohamad,
I've seen this done in slightly different ways. One way is at the very bottom of the following examples from the Cisco.com CSM-S config guide:
CSM-S Configuration Examples
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/csms/2.1.1/configuration/guide/cfgxpls.html
Another way is like this:
serverfarm REDIRECT
nat server
no nat client
   redirect-vserver REDIRECT
    webhost relocation https://www.example.com/
    inservice
serverfarm SSL_DC
no nat server
no nat client
real 192.168.78.36 local
   inservice
vserver VSERVER_80
virtual 192.168.78.35 tcp 80
serverfarm REDIRECT
persistent rebalance
inservice
vserver VSERVER_443
virtual 192.168.78.35 tcp 443
serverfarm SSL_DC
persistent rebalance
inservice
Hope this helps get you started.
Sean

Http Traffic Slow/Broken, ping fine

Similar Messages

Maybe you are looking for