Cisco PIX firewall systems are used to enforce site-specific network security policy.
The vendor recommends the following workaround.
1 Issue the commands "clear xlate" or "clear local-host <ip address on the higher security level interface>" to allow the firewall to pass connections again.
2 Modify the default TCP embryonic connection timeout to a lower value. E.g. 10 seconds.
3 Configure TCP Intercept to allow PIX to proxy all TCP connection attempts originated from behind any firewall interface after the first connection.
4 Cisco PIX/ASA software version 7.0 can be configured to verify TCP checksums. This will have a performance impact.
The information provided herein is on "as is" basis, without warranty of any kind.