Active FTP problem between Checkpoint and Cisco PIX

Hello

I am facing a strange problem.

Many of our customers have achieved a Checkpoint FW-1/VPN-1 4.1 SP6 (the last before NG). When they try to connect to an FTP server that is located behind a Cisco PIX firewall, they are not able to transfer data: the connection is established, the authentication to follow, but at the stage of the 'LIST' the connection 'freeze' and the user must close the FTP client.

Users are facing this problem ONLY in Active mode: passive mode works very well. Turn passive mode FTP client isn't acceptable workaround for most of my clients.

The problem seems to be related only to the firewall Cisco PIX and active FTP.

Please, what is someone encountered the same problem?

Could someone give me any help?

Thank you in advance.

Paolo

Yes it is a (global) problem, even with the last checkpoint firewalls. What happens with Active FTP, it's that each command (get, list, etc.) causes another log on the client (source port) to the server on port 21. If you run netstat from the customer you can check this for yourself.

What normally happens, with HTTP, FTP, telnet, which have are, it's that the client makes a connection to port 21, 23 etc then returns with a port source such as 1936, 1980, 3000, etc..

Connect problem with statefull firewall is they do not allow multiple sessions control port number on a destination, as well as a source port can be bound to a destination port, in this case, 21 for FTP. I Don t see it changed, an extreme security risk any time soon, since it s, someone else might be hopping session and block this type of traffic, it's what the stateful firewall are all about and FTP servers are problably the machines more pirated on the planet.

You´ve mentioned the workaround solution, unfortunately that s the only way, change your passive customers, I think that Unix/Linux customers have a problem with this, change your FTP server can also help, there are multiple servers that can be configured to disable Active FTP, I wouldn know exactly, I only network & firewall... maybe someone else can move on this...

Tags: Cisco Security

Similar Questions

  • VPN between ASA and cisco router [phase2 question]

    Hi all

    I have a problem with IPSEC VPN between ASA and cisco router

    I think that there is a problem in the phase 2

    Can you please guide me where could be the problem.
    I suspect questions ACL on the router, but I cannot fix. ACL on the router is specified below

    Looking forward for your help

    Phase 1 is like that

    Cisco_router #sh crypto isakmp his

    IPv4 Crypto ISAKMP Security Association
    status of DST CBC State conn-id slot
    78.x.x.41 87.x.x.4 QM_IDLE 2006 0 ACTIVE

    and ASA

    ASA # sh crypto isakmp his

    ITS enabled: 1
    Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
    Total SA IKE: 1

    1 peer IKE: 78.x.x.41
    Type: L2L role: initiator
    Generate a new key: no State: MM_ACTIVE

    Phase 2 on SAA

    ASA # sh crypto ipsec his
    Interface: Outside
    Tag crypto map: Outside_map, seq num: 20, local addr: 87.x.x.4

    Outside_cryptomap_20 ip 172.19.209.0 access list allow 255.255.255.0 172.
    19.194.0 255.255.255.0
    local ident (addr, mask, prot, port): (172.19.209.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (172.19.194.0/255.255.255.0/0/0)
    current_peer: 78.x.x.41

    #pkts program: 8813, #pkts encrypt: 8813, #pkts digest: 8813
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 8813, model of #pkts failed: 0, #pkts Dang failed: 0
    #send errors: 0, #recv errors: 0

    local crypto endpt. : 87.x.x.4, remote Start crypto. : 78.x.x.41

    Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
    current outbound SPI: C96393AB

    SAS of the esp on arrival:
    SPI: 0x3E9D820B (1050509835)
    transform: esp-3des esp-md5-hmac no
    running parameters = {L2L, Tunnel}
    slot: 0, id_conn: 7, crypto-card: Outside_map
    calendar of his: service life remaining (KB/s) key: (4275000/3025)
    Size IV: 8 bytes
    support for replay detection: Y
    outgoing esp sas:
    SPI: 0xC96393AB (3378746283)
    transform: esp-3des esp-md5-hmac no
    running parameters = {L2L, Tunnel}
    slot: 0, id_conn: 7, crypto-card: Outside_map
    calendar of his: service life remaining (KB/s) key: (4274994/3023)
    Size IV: 8 bytes
    support for replay detection: Y

    Phase 2 on cisco router

    protégé of the vrf: (none)
    local ident (addr, mask, prot, port): (172.19.209.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (172.19.194.0/255.255.255.0/0/0)
    current_peer 87.x.x.4 port 500
    LICENCE, flags is {origin_is_acl},
    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    Errors #send 0, #recv 0 errors

    local crypto endpt. : 78.x.x.41, remote Start crypto. : 87.x.x.4
    Path mtu 1452, ip mtu 1452, ip mtu BID Dialer0
    current outbound SPI: 0x0 (0)

    SAS of the esp on arrival:

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:

    outgoing ah sas:

    outgoing CFP sas:

    protégé of the vrf: (none)
    local ident (addr, mask, prot, port): (172.19.194.0/255.255.255.0/0/0)
    Remote ident (addr, mask, prot, port): (172.19.209.0/255.255.255.0/0/0)
    current_peer 87.x.x.4 port 500
    LICENCE, flags is {origin_is_acl},
    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
    #pkts decaps: 8947, #pkts decrypt: 8947, #pkts check: 8947

    compressed #pkts: 0, unzipped #pkts: 0
    #pkts uncompressed: 0, #pkts compr. has failed: 0
    #pkts not unpacked: 0, #pkts decompress failed: 0
    Errors #send 0, #recv 0 errors

    local crypto endpt. : 78.x.x.41, remote Start crypto. : 87.x.x.4
    Path mtu 1452, ip mtu 1452, ip mtu BID Dialer0
    current outbound SPI: 0x3E9D820B (1050509835)

    SAS of the esp on arrival:
    SPI: 0xC96393AB (3378746283)
    transform: esp-3des esp-md5-hmac.
    running parameters = {Tunnel}
    Conn ID: 29, flow_id: Motorola SEC 1.0:29, card crypto: mycryptomap
    calendar of his: service life remaining (k/s) key: (4393981/1196)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    the arrival ah sas:

    SAS of the CFP on arrival:

    outgoing esp sas:
    SPI: 0x3E9D820B (1050509835)
    transform: esp-3des esp-md5-hmac.
    running parameters = {Tunnel}
    Conn ID: 30, flow_id: Motorola SEC 1.0:30, card crypto: mycryptomap
    calendar of his: service life remaining (k/s) key: (4394007/1196)
    Size IV: 8 bytes
    support for replay detection: Y
    Status: ACTIVE

    outgoing ah sas:

    outgoing CFP sas:

    VPN configuration is less in cisco router

    access-list 101 permit ip 172.19.194.0 0.0.0.255 172.19.206.0 0.0.0.255 connect
    access-list 101 permit ip 172.19.206.0 0.0.0.255 172.19.194.0 0.0.0.255 connect
    access-list 101 permit ip 172.19.194.0 0.0.0.255 172.19.203.0 0.0.0.255 connect
    access-list 101 permit ip 172.19.203.0 0.0.0.255 172.19.194.0 0.0.0.255 connect
    access-list 101 permit ip 172.19.194.0 0.0.0.255 172.19.209.0 0.0.0.255 connect
    access-list 101 permit ip 172.19.209.0 0.0.0.255 172.19.194.0 0.0.0.255 connect

    access-list 105 deny ip 172.19.194.0 0.0.0.255 172.19.206.0 0.0.0.255 connect
    access-list 105 deny ip 172.19.206.0 0.0.0.255 172.19.194.0 0.0.0.255 connect
    access-list 105 deny ip 172.19.194.0 0.0.0.255 172.19.203.0 0.0.0.255 connect
    access-list 105 deny ip 172.19.203.0 0.0.0.255 172.19.194.0 0.0.0.255 connect
    access-list 105 deny ip 172.19.194.0 0.0.0.255 172.19.209.0 0.0.0.255 connect
    access-list 105 deny ip 172.19.209.0 0.0.0.255 172.19.194.0 0.0.0.255 connect

    sheep allowed 10 route map
    corresponds to the IP 105

    Crypto ipsec transform-set esp-3des esp-md5-hmac mytransformset

    mycryptomap 100 ipsec-isakmp crypto map
    the value of 87.x.x.4 peer
    Set transform-set mytransformset
    match address 101

    crypto ISAKMP policy 100
    BA 3des
    md5 hash
    preshared authentication
    Group 2
    ISAKMP crypto key xxx2011 address 87.x.x.4

    Your permit for 105 ACL statement should be down is changed to match because it is the most general ACL.

    You currently have:

    Extend the 105 IP access list
    5 permit ip 172.19.194.0 0.0.0.255 (18585 matches)
    10 deny ip 172.19.194.0 0.0.0.255 172.19.206.0 0.0.0.255 connect
    30 deny ip 172.19.194.0 0.0.0.255 172.19.203.0 0.0.0.255 connect
    50 deny ip 172.19.194.0 0.0.0.255 172.19.209.0 0.0.0.255 connect

    It should be:

    Extend the 105 IP access list
    10 deny ip 172.19.194.0 0.0.0.255 172.19.206.0 0.0.0.255 connect
    30 deny ip 172.19.194.0 0.0.0.255 172.19.203.0 0.0.0.255 connect
    50 deny ip 172.19.194.0 0.0.0.255 172.19.209.0 0.0.0.255 connect

    IP 172.19.194.0 allow 60 0.0.0.255 (18585 matches)

    To remove it and add it to the bottom:

    105 extended IP access list

    not 5

    IP 172.19.194.0 allow 60 0.0.0.255 any

    Then ' delete ip nat trans. "

    and it should work now.

  • LACP hash between N3048 and CISCO SG300/SG200 + question Twinax attach direct cable

    Hello

    In my network I have deployed two new N3048 with 2 transceivers SPF + and SPF module back + as core switches are connected to other 3 switches from edge of N2048 using optical fiber and I reused my previous CISCO SG300 and SG200 goes to serve the other two boxes of my campus via the spine in copper.

    I have 4 copper cable which starts from the hub of the SG300 network and 2 the SG200 brass. I set up to have a redundant connection using 2 + 2 with SG300 and 1 + 1 with SG200 RSTP.

    So for the SG300 I re LAG + LACP to have two channels of the N3048s port, but now that a single cable is connected because I don't know what kind of LACP hash mode should I put on N3048 to have a compatible hash between Dell and Cisco switches.

    My N3048 have mode 7 (Advanced hash) as default but I guess that cisco models do not understand... so, what mode is the best for LACP work perfectly with small business cisco switches?

    I also received my twinax cables to connect my two N3048 via SPF + back modules... conhot can I plug the cables into the slots SPF + (already mounted) without turning off my basic switches?

    Thank you!

    See you soon

    Cables can be connected/disconnected, but I don't know if the real module SFP + for the rear of the N3000 is hot plug.

  • Problem between C40 and Panasonic AW-HE50HE camera

    Hi all

    We have identified a problem between C40 and Panasonic AW-HE50HE camera with HDMI connection.

    The Panasonic camera is configured with the 720 p output, and it can display on a LCD monitor.

    However, we have connected the camera C40 and Panasonic AW-HE50HE with HDMI connection, the C40 show black screen.

    The codec C40 is confirmed as well function and its specification declared support,

    1280 x [email protected]/ * /, 59,94 Hz (720 p 60)

    1280 x [email protected]/ * / Hz (720p50)

    Anyone can provide help for me, thank you,

    Ben Lai

    Hello

    Can you telnet to the codec with the camera connected and check if the codec no video camera and what is the detected resolution.

    Teck Chye

  • IKE Dead Peer Detection between Cisco ASA and Cisco PIX

    I have a network environment in Star with about 30 offices of satellite remote using VPN Site to Site connectivity.  The majority of remote satellite offices have the features of Cisco PIX 501 running PIX Version 6.3.  The hub office runs a version 8.2 (1) Cisco ASA.

    I configured Dead Peer Detection on the Cisco ASA device at the office hub with the default settings of the following-

    Confidence interval - 10 seconds

    Retry interval - 2 seconds

    I think I'm right assuming that raises are limited to 3 before the tunnel is completely demolished.  Basically, the problem that I am facing is with several remote satellite offices.  What seems to be the case, the tunnel between the remote offices and the hub is demolished (probably because of the length of IKE, always 86400 seconds) and the tunnel then fails to renegotiate unless traffic is physically forced from the hub office.  The tunnel NOT to renegotiate after satellite office, ONLY the end of the hub; so that means sending traffic to the satellite when the VPN tunnel is out of service, not to renegotiate the tunnel.  The Hub office is a colo and therefore traffic rarely comes to that end, the tunnel remains so down until manual intervention occurs and the ICMP traffic is forced into the tunnel.

    Should the KeepAlive and retry interval settings corresponds to both ends, for example if the two devices be configured for DPD?

    What are the potential pitfalls to the extension of the life of IKE, and this will help or even hinder the problem?

    Thank you in advance for helping out with this.

    Hi Nicolas,.

    I think that the two DPD settings must match on both ends, if these do not match then problems like yours might arise which seems to happen here, is that one end shows a tunnel down, but the other end may not detect it down, we could have to watch debugs, or record two ends to see if this is the case , setting in the meantime ike DPD for same timers could hetlp on.

    In regard to the increase in the life expectancy of IKE, well you just need to be aware that this could allow keys to be discovered since these are not renegotiated unless the tunnel is down on the level of IKE. Other than that I don't see why this would affect you.

  • Difference between Csico and Cisco Unity Connection unit

    What are the main differences between Cisco Unity and Cisco Unity Connection (version 7)

    as: 1. in Cisco Unity servers are active - failover Mode and about unity, the servers are in active-active mode

    2 Cisco Unity, knows about unity and unified messaging, integrated messaging

    What is the major difference between Unified Messaging and integrated messaging?

    Please provide some points of difference between the two...

    This may well be true today, but the gap could soon close... otherwise disappear.  Cisco is currently in EFT (field-tested at the beginning) or testing "beta" for the connection of the Unit 8.5 (1), which aims to add features of Unified Messaging Unit connection using WebDav for Exchange 2003 and Exchange Web Services (EWS) for Exchange 2007/2010.  Just a nugget to think when you consider the timing of your client to install and what platform would be best suited to most environments.  Take a look at this blog for more information/thoughts:

    http://www.netcraftsmen.NET/resources/blogs/unity-connection-with-Unified-Messaging-where-will-unity-fit-in.html?blogger=David+Hailey

    Hailey

    Please note the useful messages!

  • What is the difference between restricted and unrestricted PIX?

    Please give me information on the above topic.

    Also the answer before my response.

    It depends what platform PIX you what the differences are between restricted and unrestricted. For example, the PIX535 supports up to 10 interfaces on the UR version and only 8 interfaces on the R version

    By comparing the productdescriptions on CCEL you can determine what exact difference you will have on the specific platform. If you tell us you have the platform, we can help you too, of course :-)

    Kind regards

    Leo

  • compatibility problems between DA2400ES and X930D?

    Purchasing a X930D, someone has already tried it with a DA2400ES and/or someone does know of any compatibility issues?

    Hi Zactly,

    You can connect to the TV X930D STR-DA2400ES receiver without any problem.

    There is no problem of compatibility between these products.

    Kind regards

    -Anthony

    If my post answered your question, please mark it as "accept as a Solution.

  • Problem between Labview and Melanie 2602

    Hello world

    I think my question is a bit silly, but I really don't know what the problem is. I just want to read my current solar cell by changing the level of my blood to get an IV curve, which is normally pretty easy. So, I created a loop, where I increase my voltage step by step, and used a function named VI from Labview library that connects the Keithley and Labview together, "Keithley 2600 Series.lvlib: Source Level.vi. I start at 0 and increase by 0.01 volt each time. If I use execution of climax, I see clearly the value is correct, and if I go inside the SourceLevel VI, I clearly see the command string: "smub.source.levelv = 1.6," for example, if I want to put my voltage at 1.6V. The attached picture shows a part of my code.

    Despite all this, it is clear that the Keithley does not react properly. It only works v of v 1V, 2V, 3V, etc... but never the values between. My IV curves are ok to read the Isc, but no VOCS. Never happened to any of you? I would be really happy to understand what I'm doing wrong, because it seems easy enough to solve. :/

    Thank you very much!

    It is quite difficult to debug a picture of a tiny part of the code.

    But I'll take what I see.  Your constant shows a 0.01 (comma).  So I guess that you are in a country that uses a comma instead of a decimal point.  I don't see what is happening inside the code Keithly, but I'll make an assumption that he made some conversions where it is expected that the comma is a period.

    Look closely at the code Keithly and see if that explains it.  Try to set your PC to use a period for the decimal point and try to re-run your code and see if it works better.  It is possible that Keithly conversion uses a system, rather than setting using a decimal point, which is that your sentence says it's sending.

  • Graphics problems between Jabber and SX20 VC device

    Hi all

    We have just created a SIP of our running 8.6 CUCM trunk and our device Cisco VC, I think that its a fast track.

    We can make voice calls without our IP phones problem, however when I try to make a video call to jabber client to a device of the VC, the video turns on for a second, then turns off!

    Any ideas why this would be?

    see you soon

    Carl

    Have you checked your cucm configuration the location you have set sufficient bandwidth for video. You should check the configuration of the location for jabber and sip trunk

  • EZVPN between ASA and Cisco 2801

    Hi Experts,

    Need help with establishing ezvpn. I have a Cisco 2801 with the following configuration:

    router version 124 - 24.T3 (advanceipservicesk9)

    Crypto ipsec client ezvpn BOS-BACKUP
    connect auto
    Group bosnsw keys clar3nc3
    client mode
    peer 202.47.85.1
    xauth userid interactive mode

    interface FastEthernet0/0
    IP 10.80.3.85 255.255.255.0
    automatic duplex
    automatic speed
    Crypto ipsec client ezvpn BOS-BACKUP inside

    the Cellular0/1/0 interface
    the negotiated IP address
    encapsulation ppp
    load-interval 60
    Broadband Dialer
    GSM Transmitter station
    Dialer-Group 2
    interactive asynchronous mode
    no fair queue
    a model of PPP chap hostname
    PPP chap 0 dummy password
    PPP ipcp dns request
    Crypto ipsec client ezvpn BOS-BACKUP
    !
    IP route 0.0.0.0 0.0.0.0 Cellular0/1/0
    !
    Dialer-list 2 ip protocol allow

    Celuular interface is up and the router is able to ping the exchange of vpn:

    Router # ping 202.47.85.1

    Type to abort escape sequence.
    Send 5, echoes ICMP 100 bytes to 202.47.85.1, wait time is 2 seconds:
    !!!!!
    Success rate is 100 per cent (5/5), round-trip min/avg/max = 396/473/780 ms

    The ASA configuration:

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ESP-3DES esp-3des esp-sha-hmac
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    card crypto OUTSIDE_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    OUTSIDE_map interface card crypto OUTSIDE

    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400

    username password encrypted UaV1j04bjTagjYnj privilege 0 bosnsw
    username bosnsw attributes
    VPN-group-policy DfltGrpPolicy
    Protocol-tunnel-VPN IPSec l2tp ipsec
    No vpn-framed-ip-address

    type tunnel-group bosnsw remote access
    tunnel-group bosnsw General-attributes
    address BOS_CORPORATE pool
    No ipv6 address pool
    authentication-server-group LOCAL ACS_AUTH
    secondary-authentication-server-group no
    no accounting server group
    Group Policy - by default-BOS_CORPORATE
    No dhcp server
    No band Kingdom
    no password-management
    No substitution-disabling the account
    No band group
    gap required
    certificate-CN user name OR
    secondary username-certificate CN OR
    authentication-attr-of primary server
    authenticated-session-user principal name
    tunnel-group bosnsw webvpn-attributes
    catch-fail-group policy DfltGrpPolicy
    personalization DfltCustomization
    the aaa authentication
    No substitution-svc-download
    No message of rejection-RADIUS-
    no proxy-auth sdi
    no pre-fill-username-ssl client
    no pre-fill-username without client
    No school-pre-fill-name user-customer ssl
    No school-pre-fill-user without customer name
    DNS-Group DefaultDNS
    not without CSD
    bosnsw group of tunnel ipsec-attributes
    pre-shared-key *.
    by the peer-id-validate req
    no chain
    no point of trust
    ISAKMP retry threshold 300 keepalive 2
    no RADIUS-sdi-xauth
    ISAKMP xauth user ikev1-authentication

    BOS-NRD-IT-FW1 # sh cry isa his

    HIS active: 2
    Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
    Total SA IKE: 2

    1 peer IKE: 112.213.172.108
    Type: user role: answering machine
    Generate a new key: no State: AM_TM_INIT_XAUTH_V6H

    I've attached the output of debugging of router and firewall. Hope someone can shed some light on this issue. Thanks in advance.

    Thats is correct! You must configure the network extension mode if you want to change the IP address

    Here is the guide to configure the router and ASA in network extension mode. Hope you find it useful.

    http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080809222.shtml#TS1

    Thank you

    Françoise

  • Alignment problem between IE and Firefox et al.

    I have a small space between 2 divs in IE, but the page looks fine in FF & Safari. You can see the gap just below the H in box at the top left. I have reset all margins, but the problem persists. Any help is greatly appreciated.

    URL: http://hoffmancustomconstruction.com/base.php

    HTML (CSS is lowest)

    < ! DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional / / IN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" > ""
    " < html xmlns =" http://www.w3.org/1999/xhtml ">
    < head >
    < meta http-equiv = "Content-Type" content = text/html"; charset = utf-8 "/ >"
    < title > George Hoffman Custom Construction < /title >
    < link href = "includes/HCC_style.css" rel = "stylesheet" type = "text/css" / > "
    < script src = "SpryAssets/SpryMenuBar.js" type = "text/javascript" > < / script > "
    < link href = "SpryAssets/SpryMenuBarHorizontal.css" rel = "stylesheet" type = "text/css" / > "
    < / head >

    < body class = "oneColFixCtrHdr" >

    < div id = "container" >
    < div id = "header" >


    < img src = "images/head.jpg" width = "960" height = "150" alt = "Hoffman Custom Construction" / > "
    < / div > <! - end header - >


    < div id = "mainContent" >


    < div id = "nav" >
    < ul id = "MenuBar1" class = "MenuBarHorizontal" >
    < li > < a href = "#" > HOME < /a > < /li >
    < li > < a href = "#" > OUR SERVICES < /a > < /li >
    < li > < a href = "#" > GALLERY < /a > < /li >
    < li > < a href = "#" > REQUEST a QUOTE < /a > < /li >
    < /ul >
    < / div > <! - end nav - >


    < div id = "home_cont" >
    < img src = "images/home_img.jpg" width = "565" height = "377" alt = "home" / > "
    < p > Lorem ipsum dolor sit amet, adipiscing elit our. Praesent aliquam, justo convallis luctus rutrum, erat nulla fermentum diam, at nonummy quam ante ac quam. < /p >

    < / div > <! - end home_cont - >


    < / div > <! - end mainContent - >

    < div id = "footer" >
    < p > & copy; < /p >

    < / div > <!-end #footer->


    < / div > <!-end #container->


    < script type = "text/javascript" >
    <!--
    var MenuBar1 = new Spry.Widget.MenuBar ("MenuBar1", {imgDown: "SpryAssets/SpryMenuBarDownHover.gif", imgRight:"SpryAssets/SpryMenuBarRightHover.gif"});})
    ->
    < /script >
    < / body >
    < / html >

    CSS:

    @charset "utf-8";
    {body
    Police: 100% Verdana, Arial, Helvetica, without serif.
    margin: 0;
    padding: 0;
    text-align: center;
    Color: #000000;
    }
    .oneColFixCtrHdr #container {}
    Width: 960px;
    margin: 0 auto;
    text-align: left;
    background-color: #FDF0DF;
    background-image: url (.. / images/page_left_bar.jpg);
    background-repeat: repeat-y;
    background-position: left top;
    }
    .oneColFixCtrHdr #header {}
    padding-top: 0;
    padding-right: 0px;
    padding-bottom: 0;
    padding-left: 0px;
    margin-bottom: 0px;
    background-color: #FDF0DF;
    }
    {.oneColFixCtrHdr #mainContent
    background-color: #FDF0DD;
    margin-left: 50px;
    padding-top: 0;
    padding-right: 20px;
    padding-bottom: 0;
    padding-left: 50px;
    margin-top: 0px;
    background-image: url (.. / images/vert_lines.jpg);
    background-repeat: repeat-y;
    background-position: left top;
    height: 420px;
    }
    .oneColFixCtrHdr #container #mainContent #home_cont p {}
    padding-top: 50px;
    margin-top: 0px;
    }

    .oneColFixCtrHdr #container #mainContent #home_cont img {}
    float: right;
    padding-top: 30px;
    left margin: 20px;
    margin-bottom: 0px;
    }
    #nav {}
    background-color: #FDF0DF;
    position: absolute;
    height: 35px;
    left: 450px;
    top: 115px;
    Width: 700px;
    margin-bottom: 0px;
    }
    .oneColFixCtrHdr #container #mainContent #home_cont {}
    margin-top: 0px;
    }

    .oneColFixCtrHdr #container #footer {}
    font size: 0.7em;
    background-color: #FDF0DF;
    text-align: right;
    padding-right: 50px;
    Clear: both;
    margin-left: 50px;
    background-image: url (.. / images/vert_lines.jpg);
    background-repeat: repeat-y;
    background-position: left top;
    padding-top: 10px;
    do-family: "Trajan Pro";
    letter-spacing: 0em;
    padding-bottom: 10px;

    Add the below css to your css styles and see what happens:

    .oneColFixCtrHdr #header img {}

    display: block;

    }

    Also your nav

    is positioned absolutely which means that if someone extends their browser window it does not move with the rest of the design.

    Not sure why you used absolute positioning?

  • Problems between iTunes and iPhone/iPod...

    Hello

    The problems started when iTunes has stopped to see my iPhone when I connected it to my computer. Then, an error message is appeared when I plugged in my iPod, telling me to iTunes it was detected, but there was a problem, so I needed to unplug. If the problem persisted, I had to uninstall and reinstall iTunes. What I did. No good, same problem.

    Then I happened to get a new iPhone, but once again, iTunes does not see. So I followed these steps I found on some forum:

    Right-click the Apple Mobile Device entry in Device Manager and choose Update driver software.

    • Choose "Browse my computer for driver software."
    • Choose "Let Me pick from a list of drivers for devices on my computer.
    • Click the disk button. Note: If the disk option is not present, choose a category of devices such as Mobile phone or storage device if the list and then click Next. The disk button will appear.
    • Click the Browse button and navigate to C:\Program Files\Common Apple Mobile Device Support\Drivers.
    • Double-click the file "usbaapl. (This file is called "usbaapl64" If you have a 64-bit version of Windows. If you don't see "usbaapl64" here, or if there is no Drivers folder, look in C:\Program Files (x 86) \Common Files\Apple\Mobile Device Support\Drivers. instead).
    • Click Open in the disk window. Then, click Next and then click Finish. Windows installs the driver.

    I couldn't find the bit of the file "usbaal" so, so I just typed in the "C:\Program" bit... "and installed.

    Now, iTunes tells me that my iPhone is encrypted with a password, but there is nowhere for my type a password. It may be a problem with the fact that it is a new iPhone (actually it is second hand but completely reset), but the fact that I have problems with all my devices makes me think that the problem is most likely with iTunes.

    Any help would be greatly appreciated! I'm starting to go crazy from not to be ably to change any music around and thank God for iCloud or I wouldn't be able to back up either...

    read this all along, and then act, as indicated by your symptoms

    Troubleshooting problems with iTunes for Windows updates

  • Communication problem between LabView and acquisition of data USB 6259

    I want to monitor a data USB-6259 acquisition using LabVIEW 8.6. However, when you try to create an explicit task (using the DAQ assistant) in order to acquire a signal, I get the message asked supported device found¨. I can see the USB-6259 under ¨Devices and interfaces¨ to the MAX, but when I try to import the configuration data for NOR-DAQmx 8.7.2 in MAX, I get the message ¨Can´t import file configData.nce.  File not found¨. I use NEITHER-DAQmx 8.7.2.  Any suggestions?

    Corneliu

    Hi, Corneliu,

    This question could be generated due to a corruption of database of MAX. Here is a link to restore the database to the MAX.

    http://digital.NI.com/public.nsf/allkb/2C7480E856987FFF862573AE005AB0D9?OpenDocument

    Just follow the steps and let me know if that solves the problem.

    A greeting.

    Jesus.

  • OSPF between 6224 and Cisco please!

    It is easily possible to Exchange routes using a 6224 for a Cisco 7204 OSPF? My cisco has always been eigrp between all other routers.

    I have OSPF enabled on the cisco as follows:

    router ospf 100
    Log-adjacency-changes
    redistribute subnets eigrp 1
    network 172.0.0.0 0.0.0.0 area 1

    What should I exactly say the 6224 to accept the cisco roads?

    I can find samples for the 6024, but not the 6224


Maybe you are looking for