Endpoint Cisco PIX 506

Similar Questions

• Problem recording with Pix 506

  Hello

  I have an old pix 506, it has been disconnected for a while and now I feel I want to use. But I forgot the password, I can ping from the port to my pc but I can't ping from pc-to the pix.

  No idea how to reset the password or delete it there or return to the default factory setting.

  Thank you

  See this document:

  Password Recovery and AAA Configuration procedure of recovery for the PIX

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_password_recovery09186a008009478b.shtml

  Factory reset after the recovery of password:

  write erase

  reload

  sincerely

  Patrick

• PIX 506 error VLAN switch

  Hello

  I meet a few small problems with a v6.3 (4) pix 506 and 2924c-xl switch.

  On the switch for the pix port, many input errors and Runts appear.

  On the pix, there is a VLAN configured and the trunk port is configured as

  mentioned in the Release Notes for Pix.

  I could not find a bad configuration here, but maybe someone has an idea how to

  solve this problem.

  Thank you

  just a few lines:

  [pix]

  Auto interface ethernet1

  physical interface ethernet1 vlan2

  logical interface ethernet1 vlan999

  [go]

  interface FastEthernet0/1

  PIX506 description

  switchport trunk encapsulation dot1q

  switchport mode trunk

  spanning tree portfast

  No cdp enable

  interface VLAN2

  IP x.x.x.x 255.255.255.0

  no ip directed broadcast to the

  no ip route cache

  Hello

  Do you find some useful info on the Runts on 802. 1 q port.

  Runts on an 802. 1 q trunk port.

  A catalyst 2900XL or 3500XL that receives a frame of 802 bytes. 1 q encapsulated 64 or 66 on a port trunk counts as a runt. However, it continues to transfer the weft.

  This issue occurs when you connect to the Cisco 7960 IP phones switch when using a VLAN auxiliary (voice).

  This issue is cosmetic and because of an ASIC limitation.

  It should not cause any degradation in the performance of the switch.

  For more information, see Cisco ID CSCds32999 bug (only for registered customers).

  Cisco IOS Software version 12.0 (5.4) WC1 or later

  On the errors of entry...

  Entry errors

  Entry mistakes provide a count of errors that occurred when trying to get packages from this port. The meter includes errors CRC and the framework. However, it does not include ignored packets. It is a list of entry errors:

  CRC errors: Occur when the packets received fail the CRC check.

  Frame errors: occur when the receiver frame is not complete.

  Ignored Counter: Account number of frames dropped on entry due to depletion of resources in the switch fabric.

  Meter overruns: occurs when interframe gap (IFG) are too short. In this case, a new Ethernet frame arrives before the previous one is completely stored in the shared memory.

  http://www.Cisco.com/en/us/products/hw/switches/ps607/products_tech_note09186a0080125913.shtml

  regds

• Erase the old Cisco PIX beyond recovery

  I have an old Cisco PIX that has been configured with the VPN site - to many who have been migrated to a new ASA last year.  The same IP addresses, PSK, etc are still active on the SAA new config info stored in the PIX is still valid.  I want to erase the memory on the PIX beyond all recovery-ability, to the same specifications of DoD to erase hard drives.  I don't like leaving the ASA in a usable state after - it goes to the recycling center.  I'd like to open the case to remove internal parts.

  I am aware of the process to restore the default settings, but this process is secure?  If a hacker were to get the PIX may recover data deleted from memory?  Cisco certifies all process of erasing/destroying data securely?

  Thank you in advance.

  Cisco had a download that would actually crush flash with zeros that you could use. It is no longer available because this product is long after the end of life. Even if you had a copy, it is not spec compliant DoD for sanitation.

  Unfortunately, your option at this stage would be to open the casing and physically destroy the internal memory card.

• Connectivity random Cisco Pix 501

  Hello. I'm having some trouble with my CISCO PIX 501 Setup.

  A few months I started having random disconnects on my network (from inside to outside). The machines can ping the DC or the Pix, but impossible to surf the internet. The only way to make them go outside is a reboot of Pix.

  My configuration is:

  -----------

  See the ACE - pix config (config) #.
  : Saved
  : Written by enable_15 at 09:23:07.033 UTC Tuesday, June 3, 2014
  6.3 (3) version PIX
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  activate 8Ry34retyt7RR564 encrypted password
  2fvbbfgdI.2KUOU encrypted passwd
  hostname as pix
  domain as.local
  fixup protocol dns-length maximum 512
  fixup protocol esp-ike
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol pptp 1723
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names of
  access-list acl_out permit icmp any one
  ip access list acl_out permit a whole
  access-list acl_out permit tcp any one
  Allow Access-list outside_access_in esp a whole
  outside_access_in list access permit udp any eq isakmp everything
  outside_access_in list of access permit udp any eq 1701 all
  outside_access_in list of access permit udp any eq 4500 all
  outside_access_in ip access list allow a whole
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  outside 10.10.10.2 IP address 255.255.255.0
  IP address inside 192.168.100.1 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  history of PDM activate
  ARP timeout 14400
  Global 1 10.10.10.8 - 10.10.10.254 (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
  Access-group outside_access_in in interface outside
  access to the interface inside group acl_out
  Route outside 0.0.0.0 0.0.0.0 10.10.10.1 0
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  RADIUS Protocol RADIUS AAA server
  AAA-server local LOCAL Protocol
  Enable http server
  http 192.168.10.2 255.255.255.255 inside
  http 192.168.10.101 255.255.255.255 inside
  http 192.168.100.2 255.255.255.255 inside
  No snmp server location
  No snmp Server contact
  SNMP-Server Community public
  No trap to activate snmp Server
  enable floodguard
  Permitted connection ipsec sysopt
  ISAKMP nat-traversal 20
  Telnet timeout 5
  SSH 192.168.10.101 255.255.255.255 inside
  SSH timeout 60
  Console timeout 0
  dhcpd dns 8.8.8.8 8.8.4.4
  dhcpd lease 3600
  dhcpd ping_timeout 750
  dhcpd outside auto_config
  Terminal width 80
  Cryptochecksum:7f9bda5e534eaeb1328ab08a3c4d28a
  ------------

  Do you have any advice? I don't get what's wrong with my setup.

  My DC is 192.168.100.2 and the network mask is 255.255.255.0

  The network configuration is configured to set the IP of the gateway to 192.168.100.1 (i.e. the PIX 501).

  I have about 50 + peers on the internal network.

  Any help is apprecciate.

  Hello

  You have a license for 50 users +?

  After the release of - Show version

  RES

  Paul

• Active FTP problem between Checkpoint and Cisco PIX

  Hello

  I am facing a strange problem.

  Many of our customers have achieved a Checkpoint FW-1/VPN-1 4.1 SP6 (the last before NG). When they try to connect to an FTP server that is located behind a Cisco PIX firewall, they are not able to transfer data: the connection is established, the authentication to follow, but at the stage of the 'LIST' the connection 'freeze' and the user must close the FTP client.

  Users are facing this problem ONLY in Active mode: passive mode works very well. Turn passive mode FTP client isn't acceptable workaround for most of my clients.

  The problem seems to be related only to the firewall Cisco PIX and active FTP.

  Please, what is someone encountered the same problem?

  Could someone give me any help?

  Thank you in advance.

  Paolo

  Yes it is a (global) problem, even with the last checkpoint firewalls. What happens with Active FTP, it's that each command (get, list, etc.) causes another log on the client (source port) to the server on port 21. If you run netstat from the customer you can check this for yourself.

  What normally happens, with HTTP, FTP, telnet, which have are, it's that the client makes a connection to port 21, 23 etc then returns with a port source such as 1936, 1980, 3000, etc..

  Connect problem with statefull firewall is they do not allow multiple sessions control port number on a destination, as well as a source port can be bound to a destination port, in this case, 21 for FTP. I Don t see it changed, an extreme security risk any time soon, since it s, someone else might be hopping session and block this type of traffic, it's what the stateful firewall are all about and FTP servers are problably the machines more pirated on the planet.

  You´ve mentioned the workaround solution, unfortunately that s the only way, change your passive customers, I think that Unix/Linux customers have a problem with this, change your FTP server can also help, there are multiple servers that can be configured to disable Active FTP, I wouldn know exactly, I only network & firewall... maybe someone else can move on this...

• Help with Cisco PIX 506th

  I need help setting up a Cisco PIX 506th Version 6.3 (5)

  I use the PDM to configure the device, because I don't know enough of CLI. I want to just the simplest of configurations.

  Here is what is happening, I set up then I hang the Interface 1 to my laptop and use DHCP to get an ip address, but I can't get out to the internet like that. Thanks PDM tools, I can ping outside the IPS very well.

  6.3 (5) PIX version
  interface ethernet0 car
  Auto interface ethernet1
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  activate the encrypted password of DkreNA9TaOYv27T8
  c4EBnG8v5uKhu.PA encrypted passwd
  hostname EWMS-PIX-630
  domain ciscopix.com
  fixup protocol dns-length maximum 512
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names of
  object-group service udp test
  port-object eq isakmp
  inside_access_in ip access list allow a whole
  access-list inside_access_in allow a tcp
  access-list inside_access_in allow icmp a whole
  Allow Access-list inside_access_in esp a whole
  inside_access_in tcp allowed access list all eq www everything
  inside_outbound_nat0_acl list of permitted access interface ip inside 10.10.10.96 255.255.255.240
  inside_outbound_nat0_acl ip access list allow any 10.10.10.192 255.255.255.224
  pager lines 24
  timestamp of the record
  recording of debug trap
  host of logging inside the 10.10.10.13
  Outside 1500 MTU
  Within 1500 MTU
  IP outdoor 75.146.94.109 255.255.255.248
  IP address inside 10.10.10.250 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  location of PDM 10.10.10.1 255.255.255.255 inside
  location of PDM 10.10.10.13 255.255.255.255 inside
  location of PDM 10.10.10.253 255.255.255.255 inside
  location of PDM 75.146.94.105 255.255.255.255 inside
  location of PDM 75.146.94.106 255.255.255.255 inside
  location of PDM 10.10.10.96 255.255.255.240 outside
  location of PDM 10.10.10.192 255.255.255.224 outside
  PDM logging 100 information
  history of PDM activate
  ARP timeout 14400
  NAT (inside) 0-list of access inside_outbound_nat0_acl
  NAT (inside) 0 0.0.0.0 0.0.0.0 0 0
  inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 75.146.94.110 1
  Timeout xlate 0:05:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + 3 max-failed-attempts
  AAA-server GANYMEDE + deadtime 10
  RADIUS Protocol RADIUS AAA server
  AAA-server RADIUS 3 max-failed-attempts
  AAA-RADIUS deadtime 10 Server
  AAA-RADIUS (inside) host 10.10.10.1 server timeout 10
  AAA-server local LOCAL Protocol
  Enable http server
  http 10.10.10.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  SNMP-Server Community public
  No trap to activate snmp Server
  enable floodguard
  Permitted connection ipsec sysopt
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  ISAKMP allows outside
  ISAKMP peer ip 206.196.18.227 No.-xauth No.-config-mode
  ISAKMP nat-traversal 20
  ISAKMP policy 20 authentication rsa - sig
  encryption of ISAKMP policy 20
  ISAKMP policy 20 md5 hash
  20 1 ISAKMP policy group
  ISAKMP duration strategy of life 20 86400
  part of pre authentication ISAKMP policy 40
  encryption of ISAKMP policy 40
  ISAKMP policy 40 md5 hash
  40 2 ISAKMP policy group
  ISAKMP duration strategy of life 40 86400
  ISAKMP policy 60 authentication rsa - sig
  encryption of ISAKMP policy 60
  ISAKMP policy 60 md5 hash
  60 2 ISAKMP policy group
  ISAKMP strategy life 60 86400
  Telnet 10.10.10.0 255.255.255.0 inside
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  dhcpd address 10.10.10.2 - 10.10.10.5 inside
  dhcpd dns 68.87.72.130
  dhcpd lease 3600
  dhcpd ping_timeout 750
  dhcpd allow inside
  btork encrypted Ww3clvi.ynWeGweE privilege 15 password username
  vpnclient Server 10.10.10.1
  vpnclient-mode client mode
  vpnclient GroupA vpngroup password *.
  vpnclient username btork password *.
  Terminal width 80
  Cryptochecksum:5ef06e69c17b6128e1778e988d1b9f5d
  : end
  [OK]

  any HEP would be appreciated.

  Brian

  Brian

  NAT is your problem, IE.

  NAT (inside) 0-list of access inside_outbound_nat0_acl
  NAT (inside) 0 0.0.0.0 0.0.0.0 0 0

  presumanly first NAT is fot your good VPN that acl looks a little funny, what exactly are you doing with that?

  The second NAT is the real problem but for outgoing internet access - the NAT statement, you said not NAT one of your addresses 10.10.10.x which is a problem as 10.x.x.x address is not routable on the Internet.

  You must change this setting IE. -

  (1) remove the second NAT statement IE. "no nat (inside) 0 0.0.0.0 0.0.0.0.

  (2) add a new statement of NAT - ' nat (inside) 1 0.0.0.0 0.0.0.0.

  (3) add a corresponding statement global - global (outside) 1 interface.

  This will be PAT all your 10.10.10.x to external IP addresses.

  Apologies, but these are some CLI commands that I don't use PDM.

  Jon

• Remote Desktop from Win7 not passing is not by the cisco pix firewall, but xp can.

  our company lan remote office work like this:

  Win7 for win7 ok

  Win7 for xp ok

  XP and win7 ok

  XP to xp ok

  Which leads me to believe that all the parameters and features of firewall and rdp pc work fine.

  our remote users connect via the cisco through our cisco pix vpn client business and Remote Desktop works like this:

  inside lan xp ouside xp OK

  inside lan xp ouside win7 OK

  Here's the problem:

  inside to outside win7 win7 ==> does NOT connect to (rdp that is)

  inside win7 for xp outdoor ==> does NOT connect to (rdp that is)

  External clients CAN of course accept rdp because it works when initiated by the xp machine.

  ONLY win7 machines cannot use rdp through the cisco firewall

  Yes, the dns resolves properly throughout.

  Yes, remote desktop IS active (Yes, some may ask me that...)

  Ping is not allowed through the firewall, so it makes no difference.

  the result is the same whether the win7 firewall is on or off.

  all the necessary pc firewall settings are good, as demonstrated in the first part.

  Why can you connect the NO Win7?  but the XP machines?

  Any help is appreciated, thanks.

  I think that there are some weird setting in Win7 that didn't exist in winxp.

  Hello

  The question is more suited in the TechNet forums. So I would say you mention the link and send the request in this forum for better support.

  http://social.technet.Microsoft.com/forums/en-us/category/w7itpro

  For any information related to Windows, feel free to get back to us. We will be happy to help you.

• Cisco PIX VPN pass through (sorry, tricky!)

  Hello

  I'm having some problems with allowing IPSEC through a Cisco PIX 501. The configuration is the following:

  Host (mail Client) (192.168.1.111)

  |

  PIX (NAT)

  |

  INTERNET

  |

  (Checkpoint) VPN server

  The problem is, the PIX guard dropping my outgoing isakmp packets on its * internal * inetrface!

  710005: request UDP and eliminated from 192.168.1.111/500 to inside:192.168.1.1/isakmp

  710005: request UDP and eliminated from 192.168.1.111/500 to inside:192.168.1.1/isakmp

  710005: request UDP and eliminated from 192.168.1.111/500 to inside:192.168.1.1/isakmp

  710005: request UDP and eliminated from 192.168.1.111/500 to inside:192.168.1.1/isakmp

  710005: request UDP and eliminated from 192.168.1.111/500 to inside:192.168.1.1/isakmp

  710005: request UDP and eliminated from 192.168.1.111/500 to inside:192.168.1.1/isakmp

  Does anyone know why it does this? Anyting to my in-house (security level 100) should go directly to my giving and external interface on the net. For some reason, is to treat the isakmp packets differently...

  I have included my config as an attachment, can we see what I missed or have any ideas why it loses the isakmp packets?

  Thanks for any help.

  Nick Chettle

  Check users. C and edit it with your favorite editor. Check if you have a private or public IP address!

  I tried to find in the really safe base article I've seen a couple of months ago but I can't find any more.

  https://SecureKnowledge.checkpoint.com/SK/public/intro.jsp

  See also this FAQ:

  http://www.phoneboy.com/bin/view.pl/FAQs/SecureClientFAQs

  See CheckPoint VPN-1 Guide that is on the installation CD or go to the web site of checkpoints, BUT you need a valid account Center user to read and download the documentation. Start looking at page 119 and 211.

  As usual, nothing is free at the checkpoint.

  http://www.checkpoint.com/support/technical/documents/docs_r55.html

  sincerely

  Patrick

• PIX 506 - cannot connect to PDM more

  We have a PIX 506 in a test environment that has been configured in the past using Netscape. Now when we try to connect via https, Netscape says "unable to connect to the server (TCP error: i/o error). The PIX is version 6.1 (1) and PDM is 1.0 (2). I can connect via telnet and change the configuration, but I was not able to get the connection Internet work anymore.

  I captured the connection with ethereal and I see 3 packets, the connection, then the client sends a SSLv2 Client Hello, then the PIX closes the connection. When I dump the telnet configuration, I get:

  Enable http server

  ClientName http 255.255.255.255 inside

  where clientname is defined above in the name and the entries of "place of pdm.

  The PDM installation guide has a troubleshooting section, and it says to make sure the clock is set to UTC. "show clock" indicates the time and date, but no area is listed.

  You have changed the IP address on the PIX interface at some point? If so, try to regenerate public/private key pairs. Fox

  > ca related rsa

  > key gen rsa 512 AC

  > ca save all

  or you can just run the command 'setup' from config mode and it'll do all that for you. Then try to reconnect.

• Cisco PIX 501 to Cisco 3005 concentrator via remote access

  Hello people,

  I need your help.

  We got a Cisco PIX 501 in one place and this pix is configured for pppoe connection. The pix connects to internet via the pppoe client. an official ip address ping works well.

  So what I want to do is to establish a tunnel von between this pix and a cisco 3005 concentrator.

  But I failed to establish it.

  Here are the pix config. the acl? s are only for the test and will be replaced if it works.

  6.3 (4) version PIX

  interface ethernet0 10baset

  interface ethernet1 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate the password xxx

  passwd xxx

  hostname PIX - to THE

  domain araukraine.ua

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  outside ip access list allow a whole

  inside_access_in ip access list allow a whole

  pager lines 24

  opening of session

  Monitor logging warnings

  logging warnings put in buffered memory

  MTU outside 1456

  MTU inside 1456

  IP address outside pppoe setroute

  IP address inside 192.168.x.x 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  PDM location 192.168.x.x 255.255.255.224 inside

  forest warnings of PDM 500

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  outside access-group in external interface

  inside_access_in access to the interface inside group

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  the ssh LOCAL console AAA authentication

  Enable http server

  255.255.x.x 192.168.x.x http inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  255.255.x.x telnet inside 192.168.x.x

  Telnet timeout 5

  SSH 194.39.97.0 255.255.255.0 outside

  SSH timeout 5

  management-access inside

  Console timeout 0

  VPDN group pppoe_group request dialout pppoe

  VPDN group pppoe_group localname [email protected] / * /

  VPDN group ppp authentication pap pppoe_group

  VPDN username [email protected] / * / password *.

  encrypted privilege 15

  vpnclient Server 212.xx.xx.xx

  vpnclient mode network-extension-mode

  vpntest vpngroup vpnclient password *.

  vpnclient username pixtest password *.

  Terminal width 80

  the hub, I created a user pixtest, a group vpntest and I? ve created the rules of the network for example to what server, users behind the pix will be able to access.

  And that? s all.

  I couldn't send you exit pix or hub because I don't have an error or a message that the tunnel will be established.

  What can be wrong?

  Thanks for the replies

  This configuration example shows how to create an IPsec tunnel to a computer that is running the Client VPN Cisco's (4.x and later versions) to a Cisco VPN concentrator 3000 to allow the user to safely access the network inside the VPN concentrator.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2284/products_configuration_example09186a008026f96c.shtml

• IKE Dead Peer Detection between Cisco ASA and Cisco PIX

  I have a network environment in Star with about 30 offices of satellite remote using VPN Site to Site connectivity.  The majority of remote satellite offices have the features of Cisco PIX 501 running PIX Version 6.3.  The hub office runs a version 8.2 (1) Cisco ASA.

  I configured Dead Peer Detection on the Cisco ASA device at the office hub with the default settings of the following-

  Confidence interval - 10 seconds

  Retry interval - 2 seconds

  I think I'm right assuming that raises are limited to 3 before the tunnel is completely demolished.  Basically, the problem that I am facing is with several remote satellite offices.  What seems to be the case, the tunnel between the remote offices and the hub is demolished (probably because of the length of IKE, always 86400 seconds) and the tunnel then fails to renegotiate unless traffic is physically forced from the hub office.  The tunnel NOT to renegotiate after satellite office, ONLY the end of the hub; so that means sending traffic to the satellite when the VPN tunnel is out of service, not to renegotiate the tunnel.  The Hub office is a colo and therefore traffic rarely comes to that end, the tunnel remains so down until manual intervention occurs and the ICMP traffic is forced into the tunnel.

  Should the KeepAlive and retry interval settings corresponds to both ends, for example if the two devices be configured for DPD?

  What are the potential pitfalls to the extension of the life of IKE, and this will help or even hinder the problem?

  Thank you in advance for helping out with this.

  Hi Nicolas,.

  I think that the two DPD settings must match on both ends, if these do not match then problems like yours might arise which seems to happen here, is that one end shows a tunnel down, but the other end may not detect it down, we could have to watch debugs, or record two ends to see if this is the case , setting in the meantime ike DPD for same timers could hetlp on.

  In regard to the increase in the life expectancy of IKE, well you just need to be aware that this could allow keys to be discovered since these are not renegotiated unless the tunnel is down on the level of IKE. Other than that I don't see why this would affect you.

• PIX 506 Web, Mail Config w/one IP

  Hello, I am trying to configure my Pix 506 to allow outgoing traffic all and before 25,80 port traffic, 8080 and 7777 entrants to an internal web server (192.168.1.3,4) and mail server (192.168.1.2)

  I have an external IP x.x.x.12

  What Miss me...

  Thank you. -rob

  Here is my config:

  interface ethernet0 car

  Auto interface ethernet1

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  names of

  name 192.168.1.4 NVDEV02

  name 192.168.1.3 NVAPP01

  NVEGVPN_splitTunnelAcl ip access list allow a whole

  inside_outbound_nat0_acl ip access list allow any 192.168.1.0 255.255.255.192

  inside_outbound_nat0_acl ip access list allow any external interface

  outside_cryptomap_dyn_20 ip access list allow any 192.168.1.0 255.255.255.192

  outside_cryptomap_dyn_20 ip access list allow any external interface

  outside_access_in list access permit tcp any host x.x.x.12 eq 8080

  outside_access_in list access permit tcp any host x.x.x.12 eq www

  outside_access_in list access permit tcp any host x.x.x.12 eq 7777

  outside_access_in list access permit tcp any host x.x.x.12 eq smtp

  pager lines 24

  opening of session

  information recording console

  logging trap information

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside x.x.x.12 255.255.255.0

  IP address inside 192.168.1.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  local IP NVEGPOOL 192.168.1.30 pool - 192.168.1.49

  location of PDM 192.168.1.2 255.255.255.255 inside

  location of PDM NVAPP01 255.255.255.255 inside

  location of PDM NVDEV02 255.255.255.255 inside

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  static (inside, outside) x.x.x.12 www NVAPP01 www netmask 255.255.255.255 tcp 0 0

  static (inside, outside) tcp x.x.x.12 7777 NVAPP01 7777 netmask 255.255.255.255 0 0

  static (inside, outside) tcp x.x.x.12 8080 8080 NVDEV02 netmask 255.255.255.255 0 0

  static (inside, outside) tcp smtp 192.168.1.2 x.x.x.12 smtp netmask 255.255.255.255 0 0

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 x.x.x.12 1

  Route inside 192.168.1.2 255.255.255.255 192.168.1.1 1

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server RADIUS (inside) host 192.168.1.2 nvegvpn timeout 5

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Config seems good. You have made a < clear="" xlate=""> ?

  Take care this will reset the translation of the entire table and all users will lose your sessions.

  sincerely

  Patrick

• PIX 506 - How to clear the counter on interfaces?

  Hello

  Can anyone advise on how to delete counters interface on the PIX 506 running version 6.1 (2)?

  TIA.

  PF

  You are welcome. Please mark this more closely

• Need advice choice btw 2 routers for a pix 506

  Hello world. We have a 506th pix we use for firewalls and VPN (access users to home) attached to a Hub to SBS 2000 Server.

  Here's my scenario.

  DSL---> router Netopia---> Cisco Pix506e-->--> SBS200 hubs.

  We are in the process of upgrading from a DSL line to a T1 internet connection, the T1 provider offers the Cisco 1721 router and my Adviser suggested the Cisco 1841. My question is what is the best according to your experience and my script? The T1 provider does not the 1841. Are there limitations with the vs 1721 the 1841? What is the difference BTW the 2 products, and which is the best?

  Thank you for your excellent support.

  Denise

  Hi Denise,

  I would use the PIX VPN endpoint. The 506e can do 16 Mbps 3DES throughput and 30Mbps throughput AES is clearly the best box for work, although he only software-based encryption. You can get a VPN hardware encryption for the 1721 module, but since you already have the PIX, why bother?

  Hope that help - rate pls post if it does.

  Paresh