Here is my topology: Desktop <--> Cisco C2912 Switch <--> Cisco PIX 501 <--> Internet <--> Cisco 1760(?) Router <--> Cisco C2950 Switch <--> Server Server is running Gentoo Linux with a 2.6.17 kernel When I browse to an SSL website on the Server from my Desktop, the PIX seems to be dropping the cookie the server sends me, with a syslog message such as follows: "Dropped packet (no connection)" The website works fine from three other places behind various different NAT devices (tried behind a Linksys, D-Link, and a Checkpoint), so I know it's something the Linux box is setting on the packets that the PIX does not like. After googling around a little bit, I found one other guy with a similar issue, but he had Explicit Congestion Notification (ECN) enabled on his Linux server, that was causing the PIX to think the packets with the ECN bit set were a new connection, or something like that anyway. Regardless, my Linux box does not have ECN enabled according to sysctl. What could be causing my issue?