Configuration of the PIX firewall Interface

Similar Questions

• To block P2P traffic on the PIX firewall

  What will be the mechanism, and how we can block the traffic of P2P applications like eDonkey, KaZaa and Imesh etc on the PIX firewall.

  Hello

  You can find the info here:

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_tech_note09186a00801e419a.shtml

  I hope this helps.

  Jay

• Helps to configure the pix firewall 507e for e-mail access

  Dear experts,

  I called our provider cisco and ask for technical help regarding our current problem as we know on our set-up.

  She told me to convey my concern to the Cisco TAC. My friends told me to post it here under discussion Netpro.

  I am writing today to ask a few questions about my pix 506 firewall configuration.

  To give the implementation Details pls find below and attached seizures of the show tech command.

  We have subscribed the service DSL and Singtel give us 2 addresses valid public IP that is 203.125.100.246 255.255.255.252.

  I used 203.125.100.246 for my external interface of my firewall pix and singtel assign 203.125.100.245 to the DSL router. In this case, we will only use PAT for internet connection.

  Currently he works very well our Mail Server is resided in the Singtel Office having the ip address of 165.21.111.22. Not work that we can receive and deliver electronic mail on the internet, and we can also surf the internet.

  Now we intend to put our mail in our own network server, because sometimes we encounter slowness on receiving and sending emails. Pls check on the IP address below

  Our LAN IP address is 192.168.1.X 255.255.255.0

  default gateway, which is the IP address of the firewall pix inside interface is 192.168.1.1

  The new mail server IP address is 192.168.1.4.

  Here's what I've done so far.

  I created a static mapping for my mail server is here

  public static 203.125.100.246 (inside, outside) 192.168.1.4 mask subnet 255.255.255.255 0 0

  and modify the access list to allow smtp on our networks.

  192.168.2.0 ip access list ACL_OUT permit 255.255.255.0 any

  ACL_OUT list access permit icmp any host 203.125.100.246

  ACL_OUT list access permit tcp any host 203.125.100.246 eq smtp

  ACL_OUT list access permit tcp any host 203.125.100.246 eq pop3

  ACL_OUT list access permit udp any host 203.125.100.246 EQ field

  Access-group ACL_OUT in interface outside

  After doing it... I have loss all the internet connection, the email does not work... so I deleted immediately. because it causes network failure.

  I have rather edit it and create a static map like this.

  public static 203.125.100.246 (exterior, Interior) 192.168.1.4 mask subnet 255.255.255.255 0 0

  and modify the access list to allow smtp on our networks.

  192.168.2.0 ip access list ACL_OUT permit 255.255.255.0 any

  ACL_OUT list access permit icmp any host 203.125.100.246

  ACL_OUT list access permit tcp any host 203.125.100.246 eq smtp

  ACL_OUT list access permit tcp any host 203.125.100.246 eq pop3

  ACL_OUT list access permit udp any host 203.125.100.246 EQ field

  Access-group ACL_OUT in interface outside

  Saw what it did not cause a failure of network or interruption. I thought that it will already work with the config, I keep it and this is the current config now... But when I change the POP and SMTP settings so that it points on 192.168.1.4 which is the new mail server on our LAN. his does not work.

  To this day, we are in a discussion with my boss or not possible to create a static mapping on our new mail server address 192.168.1.4 to 203.125.100.246 which is already assigned as external IP address and is used for PAT.

  We are asking your help to know how to set up our internal mail server statically match our public IP address that is already used for PAT.

  Please check attached the tech release see the.

  Thank you very much!

  I'd appreciate your quick response.

  Your truth.

  Dennis Pelea

  Dennis,

  Can you please send to me your configuration full pix (unscrew sensitive information) to [email protected] / * /

  I am puzzled, why this configuration does not for you. I have several clients who use a public ip address for external intf more than several other services that use this single ip address.

  Thank you / Jay

• Configuration of the PIX 520 with two links to Internet

  Hello.

  I have a pix 520 with four interfaces ethernet firewall, in fact I am with

  just two interfaces,

  Ethernet 0 outdoors

  Ethernet 1 inside

  ethernet2 closed intf2

  ethernet3 closed intf3

  Thus, in the interface to the outside, I have access to the internet, but now I

  access to the internet and I want to configure the two, I mean,.

  a single network inside and two internet access,

  is it posible?

  the perhaps configuration.

  Ethernet 0 (access 1) outdoors

  1 Ethernet (ip 10.1.1.1) inside

  ethernet2 outside2 (access to internet 2)

  ethernet3 inside2? (ip 10.1.1.2)?

  Thanks for the help,

  You can plug it in like that, but there is no way to route traffic by default. PIX does not support this type of connections that you can only configure a default route on the pix. This link should help describe what you can do: http://www.cisco.com/warp/public/110/pixfaq.shtml#Q18

  I hope this helps.

  Kurtis Durrett

• How to limit the ICMP on the PIX firewall.

  Guys good day!

  I have a dilemma with regard to limiting ICMP users browsing to other networks such as other demilitarized interns.

  I know that, to allow ICMP to pass through interfaces, you will need to create an ACL such as below:

  access-list DMZACL allow icmp a whole

  Users require this config ping a server on the DMZ, but it is a security risk.

  To minimize, I have a group of objects created in order to identify hosts and networks is allowed to have access to the echo-replies.

  Again, this is a problem since many host who extended pings just to monitor the connectivity server and its application.

  Do you have other ideas guys?

  As to limiting the echo answers on the PIX. As first 5 echo request succeed with 5 echo-replies and the rest would be removed.

  This could be done?

  Thank you

  Chris

  Hello.. I don't think you can do this by using an ACL on the PIX, however, you might be able to stop the ICMP sweeps by activating CODES signatures using the check ip command you... For more information see the link below

  Guidelines of use Cisco Intrusion Detection System (IDS Cisco) provides the following for IP-based systems:

  ? Audit of traffic. The application of signatures will be audited only as part of an active session.

  ? Apply to the verification of an interface.

  ? Supports different auditing policies. Traffic that matches a signature triggers a range of configurable

  actions.

  ? Disables signature verification.

  ? Always turns the shares of a class of signature and allows IDS (information, attack).

  The audit is performed by looking at IP packets to their arrival at an input interface, if a packet triggers

  a signature and the action configured does not have the package, and then the same package may trigger another

  signatures.

  Firewall PIX supports inbound and outbound audit.

  For a complete list signatures of Cisco IDS supported, their wording and whether they are attacking or

  informational messages, see Messages in Log System Cisco PIX Firewall.

  See the User Guide for the Cisco Secure Intrusion Detection System Version 2.2.1 for more information

  on each signature. You can view the? NSDB and Signatures? Chapter of this guide at the following

  website:

  http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/csids/csids1/csidsug/SIGs.htm

• default configuration of the pix 501 past recovery/restoration

  You need to reset the PIX 501 (lost password). I tried the password recovery instructions and accesses the monitor command by using the connection of the console, but cannot get the file to be transferred using tftp (ping command also expires).

  1. in case ordering interface be set to 0 or 1 (I used 1)

  2. the order of the address I was using 192.168.1.1

  3. order the server, I was using the IP address of the tftp server

  4. entry door? (Which is the PIX or the computer)?

  5. in addition to the blue console cable that if all other cables should be connected and which ports.

  Thank you

  I'm guessing you already have this document:

  http://www.Cisco.com/en/us/customer/products/HW/vpndevc/ps2030/products_password_recovery09186a008009478b.shtml

  I would like to use the default value inside of the interface of the 1. Connect a standard ethernet cable to one of the Interior ports on the PIX and the other to your PC that has the server tftp on it of the interface software. Make sure that you see a link on both ends light. If not, take this cable or save it if you think it is a crossover cable. If you set the PIX address to: 192.168.1.1, then I would set my tftp server address: 192.168.1.2 or something in the same subnet. In this way we will not care what is the gateway address. No need to let pesky routers get in the way, when we're down!

  Since you asked the question 5 above, I'll explain. You should have a console cable connected, it seems do you since you can get to the monitor > prompt. You'll also need an ethernet cable plugged in a PC running a server tftp with the IP address: 192.168.1.2 3Com made a server tftp really good F * R * E * E.

  http://support.3Com.com/software/utilities_for_windows_32_bit.htm

  Select the last file in the list. Make sure you get that file recovery of password for the Cisco link above for the PIX OS version you are running. Configure the tftp server to point to the directory containing the PIX password recovery file and you are ready. Good luck, Derrick

• Ping on the PIX firewall

  Is it possible to ping directly from low security high security without translations on a PIX?

  For example, 192.168.2.90 is currently natted to 10.0.0.4 by the pix. I want to ping directly from 192.168.2.4 to 10.0.0.4.

  I can certainly ping directly from 10.0.0.4 to 192.168.2.4.

  Please let me know if you would like to see the complete config.

  I hope I understand your question completely. You try to ping from one interface to another on your PIX. This URL explains how this can be done.

  http://www.Cisco.com/warp/public/110/31.html

• The upgrade of the PIX firewall

  I currently have two firewalls Pix 515 (v4.4 and v6.2). I want to update the v4.4, but am unable to download the software from Cisco. Whenever I try to download using the link 'download pix software', it times out.

  I have already set up a tftp server and plan on the use of monitor mode to perform the upgrade. I already did a "write net:" to save the current configuration. " In addition, the original configuration remains intact, or they will be lost after the upgrade.

  Thanks in advance.

  Looks like you may have a problem with the download or the browser proxy. Try another host and/or browser and see if it works better.

  Since the PIX 4.4 software and versions later, you can go directly to any newer version of the software. To preserve your config, but it's always a good idea to back it up before an upgrade as you did. The config in the PIX is actually not get converted when PIX is restarted with the new software - what happens the first time you do a "write mem" under the new software, it is so important to remember to do as part of the upgrade process. You can then check the config freshly recorded against your configuration of backup for all differences. In addition, it is important to check the Release Notes before upgrading, but if you have a config PIX relatively simple it will probably be fine. One thing you want to do is migrate away from lines on access lists. Cisco is a utility that allows to convert them for you, and it does a very good job as long as your config is not too complex, so I might suggest to give it a try and see how it works for you. The downloadable version of this utility must be on the same page as other PIX software download, and there are versions for Windows and Sun Solaris.

  Good luck!

• Username in the Pix Firewall

  When I do a command 'See logging' in my Cisco Pix Firewall (6.3), I am able to see the message below

  605005: x.x.x.x/33652 for eth1:y.y.y.y/telnet for the user authorized login «»

  In the message above, why the user name is not printed?

  your config has.

  Console telnet AAA authentication GANYMEDE + | RAY | LOCAL '?

• How to monitor connections dropped and rejected on the PIX Firewall / ASA?

  I need to monitor the SNMP OID of the connections dropped and rejected on the PIX and ASA firewalls. Is this possible?

  If this is the case, what SNMP OID should I monitor?

  Syslogs and Netflow (introduced in version 8.2) are your options.

  No MIB can give you the numbers of conn.

  PK

• VPN with usernames in the pix firewall

  Is there anyway to make my VPN connections in my specific user pix?

  I know it's possible with the concentrator 3000 but don't know if you can do it with a pix. I have about 10 people who need VPN in.

  Can each VPN cause a different password?

  Reason is: if I let go 1 person I don't want to have to worry about changing the passwords for all the world just deleting an account.

  Thank you

  Anthony

  In a PIX VPN connection should always be authenticated with a name of username/password extra for extra security. Up to v6.3 you used to have to store these names of user and password to an external Radius/GANYMEDE server, but to the point 6.3 now you can use the local user on the PIX database to store these.

  The commands are:

  > the client authentication card crypto LOCAL

  > user_name password

  You can have as many orders "... user name. "as you wish. If someone leaves your company simply remove it the name of the list.

• Outlook web app on the pix firewall

  Hi guru firewall,.

  Can someone here help me install my firewall cisco to work for external outlook web access. I changed a few settings and do turn internally... However I can't access outside.

  That means, when I open outlook web app on our LAN that it works, but when I try to open it via internet ISP I can not open it... "page not found".

  Pls advice how you it is resolved through the configuration of firewall pix if anyone of you has met the same thing.

  Any help is greatly appreciated.

  Best regards

  Jeric

  Jeric,

  I am very surprised to read this thread. I really appreciate your effort to do this task.

  I said, listen to me, don't forget to add a statement static so that this works, but I'm not saying you port coz I'm still looking for it.

  I had a good conversation with our cisco consultant Ken. I show him the config and it's what Ken told me to do.

  We lack this static entry.

  public static tcp (indoor, outdoor) interface www inside_mail_server www netmask 255.255.255.255 0 0

  also add to this list of access

  ACL_OUT list access permit tcp any host 203.125.100.246 eq www

  Pls let me know the result. Hope that the system will work.

  PLS, do not forget to 'Clearly Xlate' and save it.

  See you soon.

  Dennis

• Another tunnel to the PIX firewall Site2Site

  I have PIX 506 Firewall and configured site2site VPN with router on the other side and also remote VPN on PIX and both work well. I want to add an another VPN on PIX site2site with another site router can someone guide me in this regard how accompalish it. I have attached the configuration file.

  Mohammed,

  Please see the attachment; I changed the configuration and added a 2nd peer IPSec of course you will need to change the remote router accordingly too!

  Hope this helps and pls rate post if it isn't.

  Jay

• WIP 310 of configuration using the Web User Interface

  I just got my new WIP 310 - G2 phone and try to connect via my wireless router using the web interface of the phone.

  I don't see how I have the card information provided by my VoIP provider for different fields in the Web interface.

  I got information is of approximately

  • Name of user and password (phone number)?
  • Proxy IP and Port requested
  • Outgoing Port and Proxy number
  • Expire time
  • Time to package
  • DTMF relay
  • UDP Port number
  • RTP Port number

  Hope that somepone could help me with some links to documentation and advice on how to do it.

  See this link to configure WIP 310.

• NAT order of operation on the PIX firewall

  Hi all.

  Can someone refer me to a document that clearly explains the order of operations on a PIX w firewall NAT / code 6.3 (3) or 6.3 (5)?

  The statements are first aveluated? Static Nat, static policy NAT, NAT/PAT dynamics and so forth, for outbound connections?

  And for incoming connections? I know that xlate table is checked on the first place for incoming connections, but, assuming that there is no entry corresponds to an incoming packet... What is the medal in which NAT set out are avaluated?

  TKS in advance.

  Diego

  Hello

  Refers to these positions. These are the same though...

  http://Forum.Cisco.com/eForum/servlet/NetProf?page=NetProf&Forum=security&topic=firewalling&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1ddb829a/0#selected_message

  http://Forum.Cisco.com/eForum/servlet/NetProf?page=NetProf&Forum=security&topic=firewalling&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.1ddb999a/1#selected_message

  HTH

  AK