Opening of port 22 in PIX 501

I would like to access my PC location xyz. How can I open port 22 access to my pc. I use pix 501.

Can anyone provide commands to open the port so that I can access my pc.

Thank you

totally agree because only 3 commands are needed.

list of allowed inbound tcp access any eq 22

public static tcp (indoor, outdoor) interface 22 22 netmask 255.255.255.255 0 0

clear xlate

However, all of these commands are missing in the config you have posted.

Tags: Cisco Security

Similar Questions

  • Port forwarding with PIX 501

    I try to get my PIX 501 to forward traffic on port 1412 with TCP and UDP to use Direct Connect, and the problem I have is I can connect to a DC hub, but cannot establish connections with users.

    I added the following to the default configuration from the factory with a partial success:

    outside access list permit tcp any host 192.168.100.20 eq 1412

    access-list outside permit udp any host 192.168.100.20 eq 1412

    public static tcp (indoor, outdoor) interface 1412 192.168.100.20 1412 netmask 255.255.255.255 0 0

    public static tcp (indoor, outdoor) interface 1412 192.168.100.20 1412 netmask 255.255.255.255 0 0

    In the debug log set to the access list I rule this type of errors:

    Deny tcp src outside other.users.ip.addr/3099 dst within the my.public.ip.addr/1412 by access-group "access_outside_in".

    TCP request discarded outside my.public.ip.addr/45961 other.users.ip.addr/2362

    I'm quite lost as to why it does not work when I think it should. I tried several ways, opening of port ranges and no chance for a transfer of the port sucsessful.

    You can change you, outside the ACL to the following:

    outside access list permit tcp any host eq 1412

    access-list outside permit udp any host eq 1412

    outside access-group in external interface

    Save again with: write mem and also issue: clear xlate

    I would like to know if it works.

    Jay

  • Help the PIX 501 - cannot access startup.html

    I'm new to the network and has received a job to configure the PIX 501 firewall.

    The fact is:

    We use IP table rules as a firewall on a linux machine. My pc is connected to a switch. So I use the yellow network cable to connect the port of the Pix 501 0 to the port in the switch. Then I disconnect my pc of swich cable and plug into the port of the Pix 501 1.

    My pc is to use a static ip address before. I try to change to automatically get an IP address, but it will not work. So I changed the setting and use the IP address originally. Pop up message network connection icon says that the local connection is enabled. But when I try to ping 192.168.1.1, request time-out. Also I can't acess the https://192.168.1.1/startup.html.

    I have a look at Books Online cisco and shootings of disorder, but most of them talk about the configuration or more advance features. I'm still on the very basic level to try to connect to the firewall.

    I hope someone can help me. All ideas and questions are welcome. Thank you.

    Your IP address should be fine. You do not want to have the PIX connected to your local network, even if you have the Linux firewall as well as this will cause a conflict. Keep the PIX the LAN for now. Your DNS configuration will have no effect because the url you are trying to reach is based on the IP address and not the domain name if your PC has nothing to look for.

    You have to check the cable that you use - if your PIX has only an 'inside' interface, then you must use a crossover cable. If he has four so it's built in switch for a straight cable will be fine. Is what PIX model?

    After checking the cable - see if you can console in the firewall - use the blue cable that came with the PIX and set up a connection (hyper terminal) terminal with the help of 9600, 8, no 1. If you can console and then you can stick in a basic configuration you can get.

  • Port Fowarding PIX 501

    Is it possible to forward port 80 to internal ip on a PIX 501?

    I have a PIX 501, which made PAT / internal DHCP for my network. I want to forward all queries [80] http to an internal web server.

    Thank you

    Sepyh...

    You can use port forwarding to get there.

    Here is an example configuration:

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_tech_note09186a0080094aad.shtml#port

    Hope this helps,

    -Nairi

  • PIX 501 Switch hardware Issue

    My PIX 501 switch stopped working or has failed. The PIX is 10 months old. This is the second time I've seen that happen. The first time I sent it fixed by repair out of warranty, but they couldn't fix it. They said it was a chip owner they could not get from Cisco.

    In any case, the unit has power. I am able to connect through the console and the WAN via SSH port. It is fully operational with the exception of the portion of the switch of the device.

    Has anyone seen this kind of problem before? I've never seen a switch or a hub spoil. It's the second PIX to go wrong in the same local area network installed. PCs and servers all continue networking function wise, so connected to another switch.

    Is that what I can do about this problem?

    Thank you

    Vince

    Vince,

    It depends on what type contract you have. You can open a TAC case and they will let you know the track.

    Let me know if you have any questions.

    Please mark this topic as resolved, so that others can benefit from.

    Kind regards

  • PIX 501 to allow access to the ftp server

    Hello

    We have a public ip address of the pix 501 and the other, I want to access the ftp server on the internal network from the outside. I tried to configure the PDM by a static nat, which translate to the address of the FTP to the public address, but then none of the stations networks could out - how can I configure it?

    I would also like to know what ports should I open on the acl for access to the ftp server.

    Thank you, daguech

    Yes, sorry... You must use the unique host for addresses command. The access list is applied to your external interface?

    for example, the command would be:

    Access-group acl_out in interface outside

    Also, can you connect to the local ftp server behind a firewall?

  • Opening of port (s) IPSec on perimeter router

    I currently have a PIX515E session behind a perimeter. This perimeter is connected to the Internet. It has configured ACL security. I want to do is use the PIX as a VPN endpoint and so need to open some ports on the perimeter router numbers to reach the PIX. I would use IPSec running mainly between the NCP and the PIX, but have no idea what to do with the ACL on the router. It's I would say "ip permit any fw - PIX" or should I say "permit tcp PIX - fw" Can anyone help with the port number is possible. Thank you.

    You must enable the following ports.

    ISAKMP - UDP 500

    IPSEC - ESP (Protocol)

    access-list 101 permit udp any host eq 500

    access-list 101 permit esp any host

  • PIX 501 Logging

    I would like to open a session of hacking and intrusion of the attacks through a PIX 501 with a connection to broadband in a Home Office Setup. I have the camera upwards and the race and I am currently Setup with the Kiwi Syslog Dameon. What would be my best approach Logging all relevant information with the load to the bottom of the unit? Any suggestions / tips would be appreciated.

    Thank you

    It is a common logging configuration that I use:

    opening of session

    timestamp of the record

    logging trap information

    host of logging inside x.x.x.x

    No registration message 106015

    No message logging 106007

    No message logging 105003

    No registration message 105004

    No message recording 309002

    No message logging 305012

    No registration message 305011

    No message logging 303002

    No message logging 111008

    No message logging 302015

    No message recording 302014

    No message logging 302013

    No registration message 304001

    No message logging 111005

    No message logging 609002

    No message recording 609001

    No message logging 302016

    I usually do not enable the logging buffer (never use connection console it will affect performance) because it's not the messages timestamp (it only timestamps in the syslog). But the PIX loaded down with the load, you and Kiwi you before the PIX don't.

    Also turn on the IDs on the PIX.

    It will be useful.

    Steve

  • On PIX 501 6.3 intermittent Internet access (5)

    Hello

    I have a problem of access to the Internet from the local network behind a PIX 501. It worked for months, but suddenly, I discovered that Internet access is intermittent. Internet access works for about 10-15 minutes and then goes down. When I reboot the firewall or disable ARP Internet works again. I turn on debugging with 'debug arp' and I get an error message "arp-in: Dropping request outside the unsolicited nonadjacent ROUTEOUTSIDE 0002.cf69.50cf for 82.x.137.x 0000.0000.0000»

    Any ideas on what could be the problem?

    Thank you for your help.

    Kind regards.

    Hello, Couple of things to check.

    You have ICMP permitted on the external interface of the PIX. If so, can ask you someone to ping from the internet to the external IP address.

    When they ping, can you unplug the external interface and see if they receive a response in return.

    If so, then there is a problem with the access provider. They could give your IP address to another person.

    If this isn't the issue, then you open a TAC case and resolve this problem.

    See you soon,.

    Gilbert

    The rate of this post, if that helps.

  • Simple question PIX 501

    Hey guys,.

    The switch integrated on a PIX 501 will freely forward traffic between devices plugged into it, as long as they are on the same subnet? I assume that the answer is Yes. If so, is it possible to isolate one device other network traffic using the PIX only? I can t think in a certain way, but I'm not a guru PIX, so I figured that I d ask Mr. thanks a lot for any information that you may be able to provide.

    Do you hear them VLAN private?

    If so, then 'NO', it is not possible.

    There is no options at all to things like private VLAN on a PIX 501.

    Connect a Switch which suports as suppoorts this kind of features and a port of the switch to the pix.

    sincerely

    Patrick

  • Problem of recovery of password with pix 501

    Hello

    my organization uses a firewall 501 pix with version 6.2 of the software. After I lost the password I tried earasing using the faq provided on this site (using the file np62.bin through a TFTP server).

    Unfortunately, I can not connect using the password default "cisco."

    Thank you

    Raphaël Cohen, University of Tel Aviv

    Hello Raphael,.

    You need to connect to the PIX via the port on the PIX console. If you deleted the passwords, then (as mentioned before), there is NO password to access privileged EXEC access just don't hit back, now, you will need to configure a password to "enable" with command > pix # enable password - the password is case-sensitive and can be a combination of characters and numbers the length of the password is limited to 16 characters.

    You can now set access telnet as well i.e. config mode > pix (config) # telnet [masque_sous] [interface_name]

    example: (in config mode) telnet 192.168.10.10 255.255.255.0 inside

    Good idea to use the static IP address for the above, makesure to save your config with cmd: write memory

    Hope this helps - Jay

    PS. Thanks to vote this post if it helped you so that other members can use it if they have the same problem you have - that helps! Thank you.

  • PIX 501 for Cisco 3640 VPN router

    -Start ciscomoderator note - the following message has been changed to remove potentially sensitive information. Please refrain from publishing confidential information about the site to reduce the risk to the security of your network. -end of the note ciscomoderator-

    Have a 501 PIX and Cisco 3640 router. The 3640 is configured for dynamic map for VPN. The PIX 501 is set to pointing to the 3640 router static map. I can establish a tunnel linking the PIX to the router and telnet to a machine AIX on the inside network to the router. When I try to print on the network of the PIX 501 inside it fails.

    What Miss me? I added the configuration for the PIX and the router.

    Here are the PIX config:

    PIX Version 6.1 (1)

    ethernet0 nameif outside security0

    nameif ethernet1 inside the security100

    enable encrypted password xxxxxxxxxxxxxxxx

    xxxxxxxxxxxxx encrypted passwd

    pixfirewall hostname

    fixup protocol ftp 21

    fixup protocol http 80

    fixup protocol h323 1720

    fixup protocol rsh 514

    fixup protocol rtsp 554

    fixup protocol smtp 25

    fixup protocol sqlnet 1521

    fixup protocol sip 5060

    fixup protocol 2000 skinny

    names of

    pager lines 24

    interface ethernet0 10baset

    interface ethernet1 10full

    Outside 1500 MTU

    Within 1500 MTU

    IP address outside dhcp setroute

    IP address inside 192.168.1.1 255.255.255.0

    alarm action IP verification of information

    alarm action attack IP audit

    PDM logging 100 information

    history of PDM activate

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

    Timeout xlate 0:05:00

    Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00

    Timeout, uauth 0:05:00 absolute

    GANYMEDE + Protocol Ganymede + AAA-server

    RADIUS Protocol RADIUS AAA server

    Enable http server

    http 192.168.1.0 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    SNMP-Server Community public

    No trap to activate snmp Server

    enable floodguard

    No sysopt route dnat

    Telnet timeout 5

    SSH timeout 5

    dhcpd address 192.168.1.2 - 192.168.1.33 inside

    dhcpd lease 3600

    dhcpd ping_timeout 750

    dhcpd outside auto_config

    dhcpd allow inside

    Terminal width 80

    Cryptochecksum:XXXXXXXXXXXXXXXXXXX

    : end

    Here is the router config

    Router #sh runn

    Building configuration...

    Current configuration: 6500 bytes

    !

    version 12.2

    no service button

    tcp KeepAlive-component snap-in service

    a tcp-KeepAlive-quick service

    horodateurs service debug datetime localtime

    Log service timestamps datetime localtime

    no password encryption service

    !

    router host name

    !

    start the flash slot1:c3640 - ik9o3s - mz.122 - 16.bin system

    queue logging limit 100

    activate the password xxxxxxxxxxxxxxxxx

    !

    clock TimeZone Central - 6

    clock summer-time recurring CENTRAL

    IP subnet zero

    no ip source route

    !

    !

    no ip domain-lookup

    !

    no ip bootp Server

    inspect the name smtp Internet IP

    inspect the name Internet ftp IP

    inspect the name Internet tftp IP

    inspect the IP udp Internet name

    inspect the tcp IP Internet name

    inspect the name DMZ smtp IP

    inspect the name ftp DMZ IP

    inspect the name DMZ tftp IP

    inspect the name DMZ udp IP

    inspect the name DMZ tcp IP

    audit of IP notify Journal

    Max-events of po verification IP 100

    !

    crypto ISAKMP policy 1

    BA 3des

    preshared authentication

    Group 2

    !

    crypto ISAKMP policy 20

    BA 3des

    preshared authentication

    Group 2

    ISAKMP crypto key address x.x.180.133 xxxxxxxxxxx

    ISAKMP crypto keys xxxxxxxxxxx address 0.0.0.0 0.0.0.0

    !

    !

    Crypto ipsec transform-set esp-3des esp-sha-hmac vpn test

    Crypto ipsec transform-set esp-3des esp-sha-hmac PIXRMT

    !

    dynamic-map crypto dny - Sai 25

    game of transformation-PIXRMT

    match static address PIX1

    !

    !

    static-card 10 map ipsec-isakmp crypto

    the value of x.x.180.133 peer

    the transform-set vpn-test value

    match static address of Hunt

    !

    map ISCMAP 15-isakmp ipsec crypto dynamic dny - isc

    !

    call the rsvp-sync

    !

    !

    !

    controller T1 0/0

    framing ESF

    linecode b8zs

    Slots 1-12 channels-group 0 64 speed

    Description controller to the remote frame relay

    !

    controller T1 0/1

    framing ESF

    linecode b8zs

    Timeslots 1-24 of channel-group 0 64 speed

    Description controller for internet link SBIS

    !

    interface Serial0/0:0

    Description CKT ID 14.HXGK.785129 Frame Relay to Remote Sites

    bandwidth 768

    no ip address

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    encapsulation frame-relay

    frame-relay lmi-type ansi

    !

    interface Serial0 / point to point 0:0.17

    Description Frame Relay to xxxxxxxxxxx location

    IP unnumbered Ethernet1/0

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    IP nat inside

    No arp frame relay

    dlci 17 frame relay interface

    !

    interface Serial0 / point to point 0:0.18

    Description Frame Relay to xxxxxxxxxxx location

    IP unnumbered Ethernet1/0

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    IP nat inside

    No arp frame relay

    dlci 18 frame relay interface

    !

    interface Serial0 / point to point 0:0.19

    Description Frame Relay to xxxxxxxxxxx location

    IP unnumbered Ethernet1/0

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    IP nat inside

    No arp frame relay

    dlci 19 frame relay interface

    !

    interface Serial0 / point to point 0:0.20

    Description Frame Relay to xxxxxxxxxxxxx location

    IP unnumbered Ethernet1/0

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    IP nat inside

    No arp frame relay

    dlci 20 frame relay interface

    !

    interface Serial0 / point to point 0:0.21

    Description Frame Relay to xxxxxxxxxxxx

    IP unnumbered Ethernet1/0

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    IP nat inside

    No arp frame relay

    dlci 21 frame relay interface

    !

    interface Serial0 / point to point 0:0.101

    Description Frame Relay to xxxxxxxxxxx

    IP unnumbered Ethernet1/0

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    IP nat inside

    No arp frame relay

    dlci 101 frame relay interface

    !

    interface Serial0/1:0

    CKT ID 14.HCGS.785383 T1 to ITT description

    bandwidth 1536

    IP address x.x.76.14 255.255.255.252

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    NAT outside IP

    inspect the Internet IP on

    no ip route cache

    card crypto ISCMAP

    !

    interface Ethernet1/0

    IP 10.1.1.1 255.255.0.0

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    IP nat inside

    no ip route cache

    no ip mroute-cache

    Half duplex

    !

    interface Ethernet2/0

    IP 10.100.1.1 255.255.0.0

    no ip redirection

    no ip unreachable

    no ip proxy-arp

    IP nat inside

    no ip route cache

    no ip mroute-cache

    Half duplex

    !

    router RIP

    10.0.0.0 network

    network 192.168.1.0

    !

    IP nat inside source list 112 interface Serial0/1: 0 overload

    IP nat inside source static tcp 10.1.3.4 443 209.184.71.138 443 extensible

    IP nat inside source static tcp 10.1.3.4 9869 209.184.71.138 9869 extensible

    IP nat inside source 10.1.3.2 static 209.184.71.140

    IP nat inside source static 10.1.3.6 209.184.71.139

    IP nat inside source static 10.1.3.8 209.184.71.136

    IP nat inside source static tcp 10.1.3.10 80 209.184.71.137 80 extensible

    IP classless

    IP route 0.0.0.0 0.0.0.0 x.x.76.13

    IP route 10.2.0.0 255.255.0.0 Serial0 / 0:0.19

    IP route 10.3.0.0 255.255.0.0 Serial0 / 0:0.18

    IP route 10.4.0.0 255.255.0.0 Serial0 / 0:0.17

    IP route 10.5.0.0 255.255.0.0 Serial0 / 0:0.20

    IP route 10.6.0.0 255.255.0.0 Serial0 / 0:0.21

    IP route 10.7.0.0 255.255.0.0 Serial0 / 0:0.101

    no ip address of the http server

    !

    !

    PIX1 static extended IP access list

    IP 10.1.0.0 allow 0.0.255.255 192.168.1.0 0.0.0.255

    IP access-list extended hunting-static

    IP 10.1.0.0 allow 0.0.255.255 192.168.1.0 0.0.0.255

    extended IP access vpn-static list

    ip permit 192.168.1.0 0.0.0.255 10.1.0.0 0.0.255.255

    IP 192.0.0.0 allow 0.255.255.255 10.1.0.0 0.0.255.255

    access-list 1 refuse 10.0.0.0 0.255.255.255

    access-list 1 permit one

    access-list 12 refuse 10.1.3.2

    access-list 12 allow 10.1.0.0 0.0.255.255

    access-list 12 allow 10.2.0.0 0.0.255.255

    access-list 12 allow 10.3.0.0 0.0.255.255

    access-list 12 allow 10.4.0.0 0.0.255.255

    access-list 12 allow 10.5.0.0 0.0.255.255

    access-list 12 allow 10.6.0.0 0.0.255.255

    access-list 12 allow 10.7.0.0 0.0.255.255

    access-list 112 deny ip host 10.1.3.2 everything

    access-list 112 refuse ip 10.1.0.0 0.0.255.255 192.168.1.0 0.0.0.255

    access-list 112 allow ip 10.1.0.0 0.0.255.255 everything

    access-list 112 allow ip 10.2.0.0 0.0.255.255 everything

    access-list 112 allow ip 10.3.0.0 0.0.255.255 everything

    access-list 112 allow ip 10.4.0.0 0.0.255.255 everything

    access-list 112 allow ip 10.5.0.0 0.0.255.255 everything

    access-list 112 allow ip 10.6.0.0 0.0.255.255 everything

    access-list 112 allow ip 10.7.0.0 0.0.255.255 everything

    access-list 120 allow ip host 10.100.1.10 10.1.3.7

    not run cdp

    !

    Dial-peer cor custom

    !

    !

    !

    !

    connection of the banner ^ CCC

    ******************************************************************

    WARNING - Unauthorized USE strictly PROHIBITED!

    ******************************************************************

    ^ C

    !

    Line con 0

    line to 0

    password xxxxxxxxxxxx

    local connection

    Modem InOut

    StopBits 1

    FlowControl hardware

    line vty 0 4

    exec-timeout 15 0

    password xxxxxxxxxxxxxx

    opening of session

    !

    end

    Router #.

    Add the following to the PIX:

    > permitted connection ipsec sysopt

    This indicates the PIX around all ACLs for IPsec traffic. Now that your IPSec traffic is still subject to the standard rules of PIX, so launched inside the traffic is allowed to go in, but off-initiated traffic is not.

  • PIX 501 in the firewall of the Web server

    Hello

    At the suggestion of a colleague, we bought a firewall PIX 501 to protect our new Win2003 web server and a UNIX/Oracle DB server.

    I've never worked with before firewalls.

    Our servers are located in a cage at the ISP and belong to us. There are only two servers providing web site. I have read the documentation in the Getting Started book and it does not answer my question.

    We have 2 web sites with different IP numbers on our web server. Let's say 140.5.5.4 and 140.5.5.5. I understand that I have will redefine the numbers with the firewall (192,...) but I do not understand how the routers at the ISP will be able to route requests for two websites to the firewall when it has one IP number, say 140.5.5.1?

    Any help is appreciated.

    Thank you, Jerry

    Jerry,

    what you are referring is called port forwarding. Whether you a PIX with a public IP address 12.1.1.1 and your web servers are respectively and 12.1.1.2 12.1.1.3. Port forwarding is really a 2 step process:

    * a static translation of the public IP address of the PIX (12.1.1.1) at the address of the web server (12.1.1.2)...

    static (inside, outside) tcp 12.1.1.1 12.1.1.2 www www netmask 255.255.255.255 0 0

    * an intermediate statement basically "all web requests should be allowed in the pix outside of the interface"...

    driving permit tcp host 12.1.1.1 eq www everything

    Here is a link that will help you to clarify this point:

    www.Cisco.com/warp/Customer/707/28.html

    This should help you get started. Regarding the basic configuration, it takes config examples on the Cisco site, if you have access CCO.

    Let me know if it helps.

    Rob H.

  • Place a FIOS for VPN router behind PIX 501

    I have a Verizon FIOS internet connection and one of their routers wide wireless broadband, and this is a configuration of base completely... their router DHCP and firewalls, and the connection has a dynamic address.  I would put the PIX 501 behind the Verizon router as one of its clients and make the VPN PIX of other PIX 501 at other locations, such as my entire network has access to remote networks.

    Is this possible, and if yes, any who could some suggest configurations (how to address internal and external, static routes ports that may be required somewhere, etc.)?

    Thanks for any help.

    When installing my FiOS, I had already asked that it be installed on the Ethernet cable. Don't know they need to do something for you to spend the coax to Ethernet.

    The best way to test it would be to find the Media Converter (follow the coaxial cable between your FiOS router to the demarc and there should be a box with a coaxial port, some phone Sockets and an Ethernet port). If you unplug the coaxial cable and plug a laptop computer on the Ethernet port, see if your laptop takes a public IP address. If Yes, then you just have to run to your PIX501 Ethernet cable and you should be ready.

    Just to note that Verizon, according to your region, reserved DHCP assignments. This means that you may need to call Verizon and ask them to release the previous assignment of DHCP-MAC addresses. I had this happen recently. They must release the assignment then your PIX will pull a new IP address and they will book your new IP - MAC address assignment. They do this to speed up the connection to a cold start time on the router.

    Basically, they are filtering by MAC address, but rather through a sticky ARP where they clear the entry, and then the next device that connects records his MAC address and then only that device is permitted to connect to this leg of the cable. So there is a bit of work you have to do, but the most difficult part would be sitting on hold waiting for a tech, if you call to Verizon.

  • Problems with PIX 501 and Server MS Cert

    Hi all

    I have two problems with my PIX 501:

    1. registration works well. The pix has a certificate and use it with SSL and VPN connections. But after a refill, the pix certificate is lost and it has regenerated again self-signed certificate!

    Yes, I wrote mem and ca records all!

    2. at the request of ca CRL , I get the following debugging:

    Crypto CA thread wakes!

    CRYPTO_PKI: Cannot be named County ava

    CRYPTO_PKI: transaction GetCRL completed

    Crypto CA thread sleeps!

    CI thread wakes!

    And the CRL is empty.

    Does anyone have any idea?

    Bert Koelewijn

    Not sure about 1, but 2 is usually caused by the COP (Point of Distribution of CRL, basically the situation where the PIX can download the Revocation list from) listed in cert CA is in a format the PIX does not, generally an LDAP URL.

    Check the following prayer:

    Open the administration tool of CA (Certification Authority) then

    (1) right click on the name of CA and choose 'properties '.

    2) click on the tab "Policy Module".

    3) click on the button "configure."

    4) click on the tab "X.509 extensions".

    > From there, it can display the list of the "CRL Distribution Points".

    Turn off everything that isn't HTTP.

    You need to reinstall the CERT in the PIX, I think, but then it should be able to download the CRL through HTTP instead of LDAP.

Maybe you are looking for