Large file download issue

Question

When we are downloading a large file 100MB + with Internet Explorer the
workstation will at some point report that the connection was reset by the
server and we lose the download. This is kind of random and I've only seen
it in IE. I have and use Firefox at my desk and I have no trouble like
this. But our campus standard is IE and I really would like to pin this down.
My fear is the Packet filters. I went and looked at the packet filters we
have set up and was shocked to see we had 77 filter exceptions. My last
look only showed 45 so I need to sit down and review every filter exception
and thin the heard. Anyway, below are the exception for http which is what
I believe IE uses in downloading files. Right? and wanted a second option
from you guys.
We have NW 6.5 sp 5 BM 3.8 sp 4 ir3 and I use Craigs tuneup and proxycfg.
the packet typ HTTP is defines as:
Protocol TCP
SRC Port ALL
DEST Port 80
ACK bit Filtering disabled
Stateful Filtering enabled
The filter exception are:
#15
Packet Type: HTTP
Source: B57_1_EII
All Circuits
Any Address
Destination: B57_2_EII
All Circuits
66.89.73.96/255.255.255.224
Comment:
#22
Packet Type: HTTP
Source: <All Interfaces>
All Circuits
Any Address
Destination: CE1000_1
All Circuits
Any Address
Comment:
#24
Packet Type: HTTP
Source: B57_2_EII
All Circuits
Any Address
Destination: <All Interfaces>
All Circuits
Any Address
Comment: Added by BRDCFG to allow HTTP proxy.
#67
Packet Type: HTTP
Source: B57_2_EII
All Circuits
12.22.25.0/255.255.255.240
Destination: <All Interfaces>
All Circuits
192.168.3.7
Comment: Inbound http for powerschool
#75
Packet Type: HTTP
Source: B57_1_EII
All Circuits
192.168.3.6
Destination: <All Interfaces>
All Circuits
Any Address
Comment:
Thanks
David

Answer 1

When I looked at the version level of Proxy.cfg I use that you wrote it was
version 21, I did download the current version. Would the differences
between the versions cause any of the behavior I've seen. I didn't see much
in there that looked too different.
Other Comments inside the threaded message:
> On your stateful HTTP exceptions, you are:
> #15 Allowing all HTTP to network 66.89.73.96/255.255.255.224
To allow private LAN access to the Public IP subnet range to allow
management of Routers etc. that are outside of this firewall.
> #22 Allowing all HTTP to cross interface CE1000_1 - if this is the public
> interface, you are allowing all outbound HTTP without using a proxy. If
> this is the private interface, you are allowing all inbound HTTP through
> any static NAT connection.
CE1000_1 is the interface that is connected to our DMZ. We host 3 webserver
in the DMZ for public access. One is our Groupwise Webaccess.
> #24 Allowing all HTTP as long as it originates from the B57_2 interface.
> If the public IP address were also specified, it would be one of the
> default exceptions intended to allow proxy to send HTTP requests out from
> the server to the Internet. Because source/destination IP address is
> missing, it effectively allows traffic into the B57_2 interface as well,
> assuming the B57_2 interface is public.
#24 here is the default added by BM. I don't think I ever touched this one.
This is a set of filters that were imported from our earlier BM versions
when we built this box. Sounds like it should have the Public IP address
listed as the source IP. Would you suggest adding that in?
> #67 Assuming B57_2 is public, you are allowing HTTP traffic to come from
> a specific network, into a host at 192.168.3.7, via static NAT.
Correct. We have a turn key box with a windows application that is managed
by the vendor via HTTP and that is their IP range and the target IP is
192.168.3.7 and it hold a static NAT in the 66.89.73 range on the BM Server.
> #75 Hard for me to tell what this is doing, as it appears the B57
> interface is your public interface. It will allow any HTTP from IP
> address 192.168.3.6 to anywhere, but only if that address is on the B57
> side of the server, which sounds incorrect. I'm guessing that the
> 192.168.3.x network is on the CE1000 side of the server, in which case
> this is a useless filter exception.
The Interface is B57_1_EII and this is the Private LAN interface. The
intent is to allow the SPAM filter box http access to the internet without
requiring a proxy. The box is unable to accept a proxy setting and the way
it gets it's updates from the vendor is via HTTP.
Thanks
David