Clear traffic on a Pix statistics

Similar Questions

• To block P2P traffic on the PIX firewall

  What will be the mechanism, and how we can block the traffic of P2P applications like eDonkey, KaZaa and Imesh etc on the PIX firewall.

  Hello

  You can find the info here:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_tech_note09186a00801e419a.shtml

  I hope this helps.

  Jay

• Is it still possible? Customer VPN traffic through a PIX for an another VPN?

  Hi, I just want to know if the following is actually technically possible? I'm starting to think I'm trying to implement a solution that is simply not possible.

  I have the following:

  VPN<->CiscoPix506e<->Cisco3000 Clients

  VPN clients running an IPSEC VPN for the 506th Cisco PIX and can access its "internal network" very well.

  The Cisco pix is running a VPN to another company where all network traffic is nat'ed to a single address IP RFC1918 before coming out of the tunnel (requirement of the other company to avoid the problems of overlap)

  and everyone on the "internal network" can access this great VPN.

  I want that people who use the VPN client to be able to access the other site-to-site VPN. I think that NAT forced to the external company VPN is a problem.

  All of the examples for VPN VPN cross-I see specify NAT should be disabled on the entire path. I can't do it in this situation. Is it possible to make this work?

  I guess with a good statement of ACL that all my problems will be solved.

  If you just get the users connect to the cisco 3000 rather than transversing my network. I don't have for the following reasons. I have no access to the cisco 3000 vpn concentrator and a very limited amount of the tunnels that they can open for my business. I was instructed to implement a solution to facilitate the life of employees (so that they only run a VPN tunnel at a time to do their work). For the moment, they need access to the systems within our corporate network and external society through the site to site VPN (it's actually a web application). They can do this at the office but obviously not home if they attempt to use remote access.

  I have attached a diagram of the network example PDF explaining the situation.

  Networks of each address is the following (change of the actual address of the innocents :))):

  CLIENTS_VPN

  192.168.10.0/24

  Internal network

  192.168.1.0/24

  External VPN end point

  192.168.20.0/24

  Address used for NAT on the VPN

  172.16.1.1/32

  the IOS config

  local IP pool - 192.168.10.1 VPN CLIENTS - 192.168.10.254

  inside ip access list allow a whole

  access-list allowed SHEEP ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0

  access list permits EXTERNAL-ACL-VPN ip 172.16.1.1 host 192.168.20.0 255.255.255.0

  EXTERNAL-ACL-NAT of the list of permitted access ip 192.168.1.0 255.255.255.0 192.168.20.0 255.255.255.0

  IP address outside a.b.c.d 255.255.255.0

  IP address inside 192.168.10.1 255.255.255.0

  Global interface 2 (external)

  Global (outside) 1 172.16.1.1

  NAT (inside) 0 access-list SHEEP

  NAT (inside) - EXTERNAL-ACL-1 NAT access list 0 0

  NAT (inside) 2 0.0.0.0 0.0.0.0 0 0

  outside access-group in external interface

  Route outside 0.0.0.0 0.0.0.0 a.b.c.d 1

  Thank you

  Jason.

  I understand from your description of the scenario, you try to route traffic on the same interface on which it was received on the PIX. This is called pinning hair in traffic and is not currently supported in PIX (6.3).

• PIX 515 no traffic on the new IP address don't block

  We have received a new range of ips 213.x.x.x/28 from our ISP. They are routed through our existing entry door 92.x.x.146.

  The problem:
  We can not all traffic to the pix on the new 213.x.x.x/28 range.
  -If we try to ping 213.x.x.61, we get the lifetime exceeded.
  -ISP Gets the same thing of their router.
  -ISP tries ssh and gets no route to host.

  The ISP has ticked then double the Routing and the MAC address of our external interface. They are correct.

  The strange thing is that we cannot see THE log messages about the new range of incoming connection attempts. The Pix is running at the level of the journal 7.

  Does anyone have an idea what could be the problem? or suggestions for debugging the issue?

  Excerpt from config:
  7.0 (7) independent running Pix 515
  outside 92.x.x.146 255.255.255.240
  inside 192.168.101.1 255.255.255.0
  Global 1 interface (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Route outside 0.0.0.0 0.0.0.0 92.x.x.145 1
  Access-group acl_out in interface outside
  acl_out list extended access permit tcp any host 213.x.x.x eq www
  acl_out list extended access permit tcp any host 213.x.x.x eq ssh
  static (inside, outside) 213.x.x.61 192.168.101.99 netmask 255.255.255.255
  ICMP allow any inaccessible State

  192.168.101.99 is a test with http and ssh linux server

  Any help much appreciated.

  PM

  dsc_tech_1 wrote:
  I have spoken to the ISP and confirmed the MAC address of the outside interface Ethernet0
  
      ISP says
  
      ...we are sending this correctly to your pix, you should see any traffic destined for a 213.x.x.0/28 address hit your interface at 92.x.x.146/32
  
  Yes 217.x.x.81 and 217.x.x.82 are routers owned by our ISP.
  Is there anything else I can ask the ISP in terms of testing/debugging? I've run out of ideas.
  

  If the routers are owned by your ISP, then the fault lies with them. They have a routing loop in their network and that's why packages are not your firewall. You have them shown the traceroute?

  They must focus on the routeurs.81 et.82 to establish why the packets are looped between these 2 routers. Until they fix this packet will never get your firewall.

  Jon

• VPN client to PIX - no bytes received on client

  I have a PIX with 6.3 (4) and the Client VPN 5.0.06.0110.  I can establish a tunnel, but can not pass traffic beyond the PIX to the customer network.  I ping the inside of the PIX, I believe that the tunnel is very well, but maybe the ACL is bad?  Once the tunnel is established, under details statistics/Tunnel the bytes sent back, but the received bytes remaining to 0.

  If someone would like to chime, I'd appreciate it.

  pixfirewall # sh conf
  : Saved
  : Written by enable_15 at 14:45:50.611 UTC Tuesday, December 15, 2009
  6.3 (4) version PIX
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  enable the encrypted password xxxxx
  XXXXX encrypted passwd
  pixfirewall hostname
  domain xxx.com
  fixup protocol dns-maximum length 4096
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol they 389
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names of
  access-list 101 permit ip 192.168.27.0 255.255.255.0 10.10.10.0 255.255.255.0
  access-list 102 permit ip 192.168.27.0 255.255.255.0 10.10.10.0 255.255.255.0
  pager lines 24
  ICMP allow all outside
  ICMP allow any inside
  Outside 1500 MTU
  Within 1500 MTU
  IP address outside 209.xxx.xxx.248 255.255.255.255
  IP address inside 192.168.27.2 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  IP local pool ippool 10.10.10.1 - 10.10.10.254
  PDM logging 100 information
  history of PDM activate
  ARP timeout 14400
  NAT (inside) - 0 102 access list
  Route outside 0.0.0.0 0.0.0.0 209.xxx.xxx.1 1
  Timeout xlate 0:05:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + 3 max-failed-attempts
  AAA-server GANYMEDE + deadtime 10
  RADIUS Protocol RADIUS AAA server
  AAA-server RADIUS 3 max-failed-attempts
  AAA-RADIUS deadtime 10 Server
  AAA-server local LOCAL Protocol
  Enable http server
  No snmp server location
  No snmp Server contact
  SNMP-Server Community public
  No trap to activate snmp Server
  enable floodguard
  Permitted connection ipsec sysopt
  Crypto ipsec transform-set esp - esp-md5-hmac gvnset
  Crypto-map dynamic dynmap 10 transform-set gvnset
  gvnmap 10 card crypto ipsec-isakmp dynamic dynmap
  gvnmap interface card crypto outside
  ISAKMP allows outside
  ISAKMP key * address xxx.xxx.142.105 netmask 255.255.255.255
  ISAKMP identity address
  ISAKMP nat-traversal 20
  part of pre authentication ISAKMP policy 9
  encryption of ISAKMP policy 9
  ISAKMP policy 9 md5 hash
  9 2 ISAKMP policy group
  ISAKMP policy 9 life 28800
  vpngroup address ippool pool gvnclient
  vpngroup dns 192.168.27.1 Server gvnclient
  vpngroup gvnclient wins server - 192.168.27.1
  vpngroup gvnclient by default-domain xxx.com
  vpngroup split tunnel 101 gvnclient
  vpngroup idle 1800 gvnclient-time
  vpngroup password gvnclient *.
  Telnet 192.168.27.0 255.255.255.0 inside
  Telnet timeout 15
  SSH timeout 60
  management-access inside
  Console timeout 0
  Terminal width 80
  Cryptochecksum:xxx
  pixfirewall #.

  Servers on the 192.168.27.0 network probably need a route that points the 10.10.10.0/24 network to the PIX. It is possible that your customer VPN traffic if he imagines, but the other end does not know how to get back.

• Win2K NAT would be from 1650 to a PIX 515 - does not

  Hello

  :

  I have a working VPN config on my 515 (6.2.2) and can tunnel from one host with a valid external IP without any problem. But, with a NAT would be customer, nothing seems to work.

  I use RADIUS to authenticate after using a password for the group. Here is the sequence of events.

  (1) client machine as a 10.0.0.1 address, NAT had a public address to come into the port of 'outside '.

  (2) the client connects, the user enters GANYMEDE password and is connected.

  (3) the user tries to browse any service and can not.

  (4) if the user switches DNS to an external server, the portion of the split tunnel internet works fine but inside is still broken.

  (5) clients with static IP addresses that are publicly routable connect and can perform all internal and external activities of split tunnel.

  Excerpts from config. I'm doing something wrong?

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp - esp-md5-hmac noaset

  Crypto dynnoamap dynamic-map 10 transform-set noaset

  noamap 10 card crypto ipsec-isakmp dynamic dynnoamap

  Harpy of authentication card crypto client noamap

  noamap interface card crypto outside

  ISAKMP allows outside

  ISAKMP identity address

  part of pre authentication ISAKMP policy 10

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  vpngroup address noapool pool noagroup

  vpngroup dns 66.119.192.1 Server noagroup

  vpngroup noagroup wins server - 66.119.192.4

  vpngroup noagroup by default-field noanet.net

  vpngroup split-tunnel vpn - IP noagroup

  vpngroup idle 3600 noagroup-time

  vpngroup password noagroup *.

  Help and thanks in advance.

  Mike

  You do not have something wrong. The problem is that NAT (NAT actually PAT, port) and IPSec is not working very well, and many features PAT can PAT IPSec traffic to all (PIX included until version 6.3).

  The problem is that PAT depends on using the port number TCP or UDP source as a way to differentiate between sessions, because they are all PAT would be from the same source IP address. However IPSec (ESP at least), tracks right on top of IP, in other words, it is NOT a TCP or UDP protocol, and therefore has no associated port number. It breaks most of the PAT devices.

  The reason for which you can build your tunnel initially, it is that it is all done by ISAKMP, which is a UDP protocol, which can be PAT would be fine. Once the tunnel is built however, all encrypted data are sent by packs of ESP, which as I said, is not a TCP or UDP protocol.

  Trnalsations NAT static work cause they do not rely on the use of the port number, they just change the address of the source that works very well with ESP.

  There is not much you can do about it. If you were closing the VPN into a VPN3000 concentrator, it has a feature called IPSec through NAT, which encapsulates all ESP packets in a UDP packet, which can then be PAT would be properly. The PIX, unfortunately, doesn't have this feature. The only solution is to get a NAT device that manages properly the IPSEc. Surprisingly, some of the less expensive devices on the market handle it, but you should check with each manufacturer to be sure.

• Interaction of Ganymede + and radius ACS 2.6 download PIX ACLs

  We have ACS v2.6 running and control our connection to remote, routers and switches access. We are now looking to add support for a PIX firewall internal and want to use downloadable ACS ACL for the PIX. (to control outbound traffic through the PIX for authenticated users)

  We have achieved this help attributes RADIUS of Cisco IOS/PIX

  [009\001] cisco-av-pair on ACS. (and ACL restrictions of access on access to users)

  However the problem we noticed is that any user is valid in our database of CiscoSecure or SecureID can authenticate and gain access to through the firewall, even if they are not allowed to do this (and as it is by default on PIX from inside to outside is allowed unlimited full access).

  Was then imposed restrictions on network access on the CiscoSecure ACS for our PIX - to allow only access of corresponding user groups, but it did not work with RADIUS only GANYMEDE + (I guess that's because the RADIUS does not support approval).

  We must work with GANYMEDE + and the passes of the ACS to the bottom of the ACL number/ID for the PIX for users allowed.

  Question: We want to use downloadable s ACL of ACS for the PIX (for reasons of central support) is possible using GANYMEDE + and if yes how we re CiscoSecure ACS suitable for the ACL example below;

  pix_int list access permit tcp any host 10.x.x.x eq 1022

  pix_int list access permit tcp any host 10.x.x.x eq 1023

  Thank you

  Download ACL works only with the RADIUS, as described here:

  http://www.Cisco.com/warp/public/110/atp52.html#new_per_user

  You can continue to set the ACL on the PIX itself and simply pass the ACL via GANYMEDE number (as shown here: http://www.cisco.com/warp/public/110/atp52.html#access_list), but you can actually spend the entire ACL down via GANYMEDE, sorry.

• How Pix manages the rare IP protocol packets

  Does anyone know of a document explaining how the Pix handles, regarding the State, rare IP protocol packages such as ESP, AH, OSPF, GRE, etc. ? I'm concred with traffic flowing through the pix is not intended.

  I understand how TCP, UDP, and ICMP packets are handled, but I can't find anything on all others.

  Thank you.

  In General, the Pix must inspect any protocol passes through it accepts for TCP and UDP. The exception is a protocol which is managed by a '' correction '' like PPTP which has a correction to allow GRE (Protocol 47) traffic that results.

  If you want a different protocol than UDP/TCP to be allowed to get THROUGH, you almost create an ACL entry for her.

  The other exception is the traffic to the Pix itself as host. ACL have absolutely no effect on the traffic to the Pix as the host. For example, the packets OSPF intended for the Pix when running OSPF. Or packages ESP for the Pix for a VPN tunnel, it stops. Or ICMP traffic to the Pix itself (controlled using the command [icmp]). ACL don't apply to transit traffic.

• Simple question PIX 501

  Hey guys,.

  The switch integrated on a PIX 501 will freely forward traffic between devices plugged into it, as long as they are on the same subnet? I assume that the answer is Yes. If so, is it possible to isolate one device other network traffic using the PIX only? I can t think in a certain way, but I'm not a guru PIX, so I figured that I d ask Mr. thanks a lot for any information that you may be able to provide.

  Do you hear them VLAN private?

  If so, then 'NO', it is not possible.

  There is no options at all to things like private VLAN on a PIX 501.

  Connect a Switch which suports as suppoorts this kind of features and a port of the switch to the pix.

  sincerely

  Patrick

• PIX 515e VPN 3005 concentrator cannot pass phase 1

  My list of vpn access increases, so I know that it is correct. IM testing with ping. Debug configurations and follow. Remote location through VPN connection attempt with THE. Thanks to all who can help. His failure in the first phase which means configuration mess up, but I can't find a miss-match for me? Maybe ive been looking at this for a long time.

  Pix515e config:

  ----------------

  Crypto ipsec transform-set esp - esp-md5-hmac aptset

  aptmap 10 ipsec-isakmp crypto map

  aptmap 10 correspondence address vpn crypto card

  card crypto aptmap 10 peers set yyy.xxx.xxx.131

  card crypto aptmap 10 transform-set aptset

  aptmap interface card crypto outside

  ISAKMP allows outside

  ISAKMP key * address yyy.xxx.xxx.131 netmask 255.255.255.255

  part of pre authentication ISAKMP policy 10

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  Debugs ipsec, isakmp, ca

  -------------------------

  Peer VPN: ISAKMP: approved new addition: ip:yyy.xxx.xxx.131 Total VPN peer: 1

  Peer VPN: ISAKMP: ip:yyy.xxx.xxx.131 Ref cnt is incremented to peers: 1 Total peer VPN: 1

  ISAKMP (0): early changes of Main Mode

  ISAKMP (0): retransmission of phase 1... IPSEC (key_engine): request timer shot: count = 1,.

  local (identity) = zzz.xxx.xxx.226, distance = yyy.xxx.xxx.131,

  local_proxy = 192.168.33.0/255.255.255.0/0/0 (type = 4),

  remote_proxy = 192.168.65.0/255.255.255.0/0/0 (type = 4)

  ISAKMP (0): retransmission of phase 1...

  ISAKMP (0): delete SA: src zzz.xxx.xxx.226 dst yyy.xxx.xxx.131

  ISADB: Reaper checking HIS 0x81377ad8, id_conn = 0 DELETE IT!

  Peer VPN: ISAKMP: ip:yyy.xxx.xxx.131 Ref cnt decremented to peers: 0 Total of VPN peer: 1

  Peer VPN: ISAKMP: deleted peer: ip:yyy.xxx.xxx.131 VPN peer Total: 0

  results of ' show crypto isamkp his. "

  -----------------------------------

  Total: 1

  Embryonic: 1

  Src DST in the meantime created State

  YYY.xxx.xxx.131 zzz.xxx.xxx.226 MM_NO_STATE 0 0

  Error messages on the concentrator 3005

  ------------------------------------

  11:14:47.640 57 07/01/2004-SEV = 4 RPT IKE/48 = 23 yyy.xxx.xxx.226

  Support useful treatment of error: ID payload: 1

  11:15:02.770 58 07/01/2004-SEV = 4 RPT IKE/48 = 24 yyy.xxx.xxx.226

  Support useful treatment of error: ID payload: 1

  3005 page concentrator Lan-To-Lan settings

  -----------------------

  Activated

  External interface

  Answer only

  YYY.xxx.xxx.226 peer

  Digital cert: no (use preshared keys)

  Transmission of the CERT: (full certification chain)

  Preshared key: {same on pix}

  AUTH: esp, md5, hmac-128

  encryption: des-56

  proposal of IKE: IKE-DES-MD5

  Filter: none

  IPSec NAT - T not verified

  No bandwidth policy

  Routing: no

  I noticed that you have a lifetime and a pfs group configured on the pix. The pfs group is 2 which I think will not work with-although I'm not positive, as I have only used with 3des. Diffie-Hellman Group1 should work with simple.

  In any case, recheck the config vpn 3000 to see if a group and life expectancy have been speced on config. If not, or if you are not sure, then remove the two outside the pix and run the command of his clear cry on the pix. Then try again and let me know what you find.

• PIX 501 license

  Cisco PIX 501, offered a license based on the connection: 10 or 100 users. What that means (e.g. for a 10 user license):

  -a maximum of 10 xlates in the nat table?

  -a maximum of 10 connections in the table conn?

  If finally we're true, a user can establish 10 outbound connections (from an ip address). Currently, other users cannot establish a connection outboung?

  Thank you

  Edgar

  "User" is defined as follows:

  -a sent or received traffic via the PIX in the last xlate timeout seconds (five minutes with 501 default config).

  -has a TCP or UDP connection

  -a a NAT session

  -a a session to authenticate user

  It is certainly not the number of connections, but basically, the number of unique IP addresses internal that have any number of connections through the PIX. The 501 will support up to approximately 26000 connections, but only 10 internal IP addresses could use those.

  You can make a "host local sho ' on the PIX to see all the current"users. "

• Determination of available on the PIX (10 users) user licenses

  I know that you can log in to the PDM PIX and click on "Oversight" and "Licenses" and see the number of licenses in use user. Y at - it a command line that tells you this same value? I'm looking for some kind of "show user lic" and report to me the number of licenses currently in use, what MAC addresses are machines related to each license, and when those classified.

  Which raises the second question - these licenses client age over a period of time? If so, what are the parameters.

  My third question is how I can delete these licenses. I know I can type "clear xlate" but is there a different/better method?

  Please notify.

  Hello.. Try the local host command local-host/clear show

  "A PIX 501, deforested hosts are released from the license limit. You can view the number of hosts that

  are taken into account within the limits of the license with the local-host command to show. "

  I hope this helps... Please, write it down if she does!

• PIX 515E (7.0.1) - problem with the VPN connection between inside and outside

  Hello

  I ve creates a VLAN on the pix.

  In this VLAN, users are allowed to connect only to the Internet. Everything is fine, but when trying to connect with his VPN Client to their company, it has problems... (Outside traffic flow, but no traffic came back.)

  Is the only solution for this problem to create a Pool of Nat with public ip addresses, one to one mapping, or is there another solution with a public IP address (NAT on PAT) possible for this problem?

  Thanks for your replies.

  D.

  The problem is that the esp is an IP Protocol, so PAT will not work in this scenario. When the return traffic returns to pix he doesn't know how to get to the inside host. The only way to do this is by adding a static nat (1 to 1 mapping) and create a rule to allow esp. Is what type of vpn client? Microsoft vpn? Cisco vpn? If cisco VPN, perhaps, they can use NAT - T on the vpn that overcomes the question PAT by encapsulating ipsec within UDP packets. You need to talk to the admin VPN and itself it allow.

  -kevin

• Nightmare config of SSM - AIP 7.0 (1) overall correlation.

  Thank you, Cisco, for the creation of a nightmare of management with your "Overall Correlation" option in version 7.0...

  Lets start with the management interface of the AIP-SSM-20...

  We have an OOB management network, with a single PI in this by another device of PIX515E. Both the ASA5540 AND the AIP-SSM-20 are in this network.

  The first issue was in routing, as the ASA sees the "directly attached" management network, and we ROUTE traffic via the PIX of updates on the SSM module, we had to add translation entries in the PIX515E for the SSM (management 10.x.x.x, translated of 172.x.x.x) module.

  It wasn't a big deal, but this is where the nightmare begins...

  First a note: we have locked network management CLOSE, only a few network management stations authorized in this network to access these devices.

  I activated the overall correlation in test mode, but it was 'impossible' whenever he tried to update... Reading other posts, I created ACLs and static NAT in the PIX515E for these IP addresses:

  204.15.82.17 (IP listed in the IME global correlation update server)

  97.65.135.170 et.137 (from another post in these forums)

  207.15.82.17 (IP found in a trace)

  Still no update. Research in the papers of PIX, I found "no translation" entries for the following addresses:

  198.133.219.25

  209.107.213.40

  208.90.57.73

  I put these in, and he started to be updated! FIXED? NOT!

  This morning, he wasn't yet... Looked again into the PIX logs and found these:

  77.67.85.33

  77.67.85.9

  Registered, and the SSM is happy again. How long? Who knows?

  So, now I have NINE holes in my 'secure' network, and who knows what Cisco will change or add new IP addresses to this list.

  Cisco, if you listen - ALL access to the overall correlation with a single IP address? PLEASE?

  (use the one listed in the IME - 204.15.82.17 for the URL "manifests.ironport.com" - updated)

  Some of the addresses are owned by Cisco (initially ironport.com addresses the acquisition of ironport) and are used as clear servers to provide the sensor a list of files to download.

  The sensor then downloads the files from servers Akamai. Akamai has a large number of servers around the world. Cisco sends the update of Akamai, and they reproduce on their servers. When the sensors are trying to connect to the Akamai server it is a DNS query and by controlling the DNS response, it can lead more sensors to an Akamai server located near the sensor. This allows better load balancing, response time and download speeds.

  However, Akamai has a large number of global servers (in thousands I think), and you can't predict what your specific sensor server is directed to.

  Sensor for connections to the servers from cisco for the manifest (list of files) is on port 443 and usually the update URL - manifests.ironport.com.

  Sensor connections to Akamai servers for actual file downloads are on port 80, and usually to the updates.ironport.com URL.

  The above is based on my limited knowledge of the operation between the updates. I may have gotten the details slightly wrong, but should at least give you a general idea.

  I will work with development to get to this better documented in the Release Notes and the Readme with the next version of the IPS software.

• IPSec woes - problems after the installation of firewall between IPSec endpoints

  Hi all

  I recently had to install some pix from our internet router to some internal routers in a branch. A small preview:

  router Internet <-->PIX pair FO <-NAT->routers <-->Switch Fabric

  Basically, internal routers used to have interfaces with IPs turned to the audience of our external block. I had 2 tunnels GRE IPSec running on one of them and had users who log in to the House through 1721 s. Since we have very little space, I had public address the PIX redirect internal routers and go from there.

  So, here's where I am--my tunnels show top/towards the top, but I can't talk about anything that either internally sent by routers. All this worked * prior * me having to redirect internal routers to get the firewall in. I'll post all three configs (firewall, router, router internal) to cleaned formats such as text attachments. Note, also, that I left the pix traffic large shipping open until I can solve this problem. I'll reapply my more restrictive ACL when this is fixed.

  Just as a point of reference:

  200.200.200.200 - static IP router (by ISP)

  100.100.100.100 - public ip address who * was * on our external interface of our internal router, which is now on the pix as a static to the new ip address of the router.

  172.18.201.0/24--Le internal network, I created to re - treat routers to be originally the inside interface of the pix

  Example of House is the remote router of 1721, the Interior router example is the internal router and firewall example is our pix 525 just installed.

  I would like to know if there is more I should include...

  Thanks in advance!

  -Tim

  The statement of the route on the pix will require the subnet mask:

  Route inside 100.100.100.100 255.255.255.255 172.18.201.4

  After you change the static method, remember to do a clear xlate on the pix: clear xlate local 172.18.201.4

  You don't need to assign the card encryption at int of closure. If you do, these are in global configuration on the router mode:

  card crypto mapname-address loobackx, where x is the number of loopback, and mapname is the name of your crypto card (homevpn, I think it was). If the local address is not the right option, simply enter the card encryption? to invite the global configuration and you should see text referring to the allocation of an IP as source for traffic using ipsec.

  Notes:

  1. on the router tunnel interface will use the same loopback interface as its source too. With the card encryption applied to the actual physical interface routing if you do not have to create maps of route to route to the closure to apply ipsec processing.

  This should take care of the GRE and IPSec traffic. Is there any other traffic should I consider?

  Take care to archive the current configs on the internal router and pix before you make these changes to restore more easily to the case where things go wrong.