PIX OS 6.3 and QoS

Similar Questions

• PIX-to-client VPN and how to reach on other interfaces systems

  Hi all

  I've implemented a Pix-to-Client VPN and it seems works ok.

  As you can see, customer gets the same inside the class address (192.168.100.x) so I can reach across systems.

  My questions are:

  If I give different subnet pool addresses, how can 1 I still reach inside systems?

  2 if I have other systems on these interfaces such dmz1 (192.168.10.0) dmz2 (192.168.20.0) how to get to these systems of the

  even the client vpn access?

  Concerning

  Alberto Brivio

  IP local pool vpnpool1 192.168.100.70 - 192.168.100.80

  access-list 102 permit ip 192.168.100.0 255.255.255.0 192.168.100.0 255.255.255.0

  NAT (inside) - 0 102 access list

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set esp - esp-md5-hmac trmset1

  Crypto-map dynamic map2 10 set transform-set trmset1

  map map1 10 ipsec-isakmp crypto dynamic map2

  map1 outside crypto map interface

  ISAKMP allows outside

  ISAKMP identity address

  part of pre authentication ISAKMP policy 10

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  vpngroup address vpnpool1 pool test

  vpngroup split tunnel 102 test

  vpngroup test 1800 idle time

  test vpngroup password *.

  It is generally preferable to use another range of IP addresses. The PIX will know that the VPN Client uses that vary and route it properly whitch is not the case when you are using the same IP range as the inside interface.

  To access another interface use the SHEEP (your ACL 102) access list which disables NAT between the VPN and the neworks to which you want to connect.

  Example of config:

  access-list allowed SHEEP Internalnet ISubnetMask VPN-pool 255.255.255.0 ip

  access-list allowed SHEEP DMZnet DMZSubnetMask VPN-pool 255.255.255.0 ip

  NAT (inside) 0 SHEEP

  AAA-server local LOCAL Protocol

  AAA authentication secure-http-client

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS

  Crypto-map dynamic outside_dyn_map 20 game of transformation-TRANS

  card crypto 65535 REMOTE ipsec-isakmp dynamic outside_dyn_map

  REMOTE client authentication card crypto LOCAL

  interface card crypto remotely outside

  ISAKMP allows outside

  ISAKMP identity address

  ISAKMP nat-traversal 20

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  IP pool local VPNPool x.y.z.1 - x.y.z.254

  vpngroup VPNGroup address pool VPNPool

  vpngroup VPNGroup dns-server dns1 dns2

  vpngroup VPNGroup default-domain localdomain

  vpngroup idle 1800 VPNGroup-time

  vpngroup VPNGroup password grouppassword

  username, password vpnclient vpnclient-password

  sincerely

  Patrick

• Limit my bandwidth downloading the applications using the API to control traffic and QoS

  I used QoS and Traffic Control API as TcAddFlow and TcAddFilter to control my bandwidth usage download applications.

  We manipulate TC_GEN_FLOW, to send and receive FLOWSPEC parameters.

  Now, I want to set the exact limit to 5 Mbps, what are the value that I need to set for TokenBucketSize and TokenRate to limit bandwidth to 5 Mbps FLOWSPEC structure?

  Code snippet:

  newFlow-> ReceivingFlowspec.DelayVariation = QOS_NOT_SPECIFIED;
  newFlow-> ReceivingFlowspec.Latency = QOS_NOT_SPECIFIED;
  newFlow-> ReceivingFlowspec.MaxSduSize = QOS_NOT_SPECIFIED;
  newFlow-> ReceivingFlowspec.MinimumPolicedSize = QOS_NOT_SPECIFIED;
  newFlow-> ReceivingFlowspec.PeakBandwidth = POSITIVE_INFINITY_RATE;
  newFlow-> ReceivingFlowspec.ServiceType = SERVICETYPE_NETWORK_CONTROL;
  newFlow-> ReceivingFlowspec.TokenBucketSize = ?;
  newFlow-> ReceivingFlowspec.TokenRate =?;

  newFlow-> SendingFlowspec.DelayVariation = QOS_NOT_SPECIFIED;
  newFlow-> SendingFlowspec.Latency = QOS_NOT_SPECIFIED;
  newFlow-> SendingFlowspec.MaxSduSize = QOS_NOT_SPECIFIED;
  newFlow-> SendingFlowspec.MinimumPolicedSize = QOS_NOT_SPECIFIED;
  newFlow-> SendingFlowspec.PeakBandwidth = POSITIVE_INFINITY_RATE;
  newFlow-> SendingFlowspec.ServiceType = SERVICETYPE_NETWORK_CONTROL;
  newFlow-> SendingFlowspec.TokenBucketSize =?;
  newFlow-> SendingFlowspec.TokenRate =?;

  Thank you & best regards

  This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)
  http://social.technet.Microsoft.com/forums/en-us/home s/fr-U.S./Accueil
  http://social.msdn.Microsoft.com/Forum
  
  
  If you give us a link to the new thread we can point to some resources it

• FlexVPN and QoS on tunnels

  There is a simple topology: a hub and spoke. FlexVPN is woking together with psk, BGP, and no RADIUS.

  Now I want QoS on the hub and the spokes. The Center has an ISP connection, let's say 100 MB and some rays have 10 MB, some 5 MB and so on.

  Each ray has a tunnel interface and a virtual-template interface. I can apply "service-policy output" on these interfaces, no problem. (Should I apply "service-policy output" on the tunnel or on the interface virtual-template interface or both of them, I'm still not sure, but this isn't a big problem)

  What should I do with the hub that does that one tunnel interface and a virtual for all model the rays?

  If I had 100 spokes hub would still have only a single tunnel interface and a virtual model for all the rays. The hub also has virtual-access interfaces for each Department, they sort of dynamics, I do not create them, they appear by themselves and I am not able to configure. When I try to configure the Cisco says: % Please use virtual model to configure your virtual access.

  Where and how I can apply 'service-policy output' on the hub so I want unique QoS for each Department?

  Given that you use no RADIUS, you can apply config dynamically with AAA attribute lists.

  I described the similar config (including a very basic policy) in this document http://www.cisco.com/c/en/us/support/docs/security/flexvpn/116032-flexvp...

  To answer your questions, you always apply the config to go through the model.

  (In this case) Attributes are added to the don't go to STM, you use VT as a basis for what you need, followed by additional dynamic attributes for SAV.

  For interfaces tunnel (on the shelves), it is quite easy to enable QoS, but what you could look on the wall policy on the physical interface and not the tunnel interface (do not forget that the DSCP values are copied on to external header). After all, you want to manage the bandwidth to ISP not to cloud VPN, most of the time.

• bandwidth and QOS

  Hi guys,.

  I get a line of lease 20Mbps between two offices and it connects two cisco C4507R switches. I have configured the QOS on the two switches, and I know the QOS will take effect when the network congestion occurs. But the ports that connect the rental displays 100 Mbps on the switch. So I configured 'bandwidth 20480' command in the ports, if this will help active QOS when the network stream is up to 20Mbps?

  my command under the interface:

  interface GigabitEthernet1/38

  No switchport
  bandwidth 20480
  IP 10.81.16.4 255.255.255.248
  service-policy output QOS - SH

  Disclaimer

  The author of this announcement offers the information in this publication without compensation and with the understanding of the reader that there is no implicit or explicit adequacy or adaptation to any purpose. Information provided is for information purposes only and should not be interpreted as making the professional advice of any kind. Use information from this announcement is only at risk of the reader.

  RESPONSIBILITY

  Any author will be responsible for any wha2tsoever of damage and interest (including, without limitation, damages for loss of use, data or profits) arising out of the use or inability to use the information in the view even if author has been advised of the possibility of such damages.

  Poster

  Your 4500 QoS will only engage when the interface clutter.

  What you need is a shaper with QoS support, that can match bandwidth your provider.

  Unfortunately, this is not a feature of the 4500 series.

• Configure the PIX to use GANYMEDE and RAY for VPN

  Using PIX 506th ver 6.3: whenever I have add the command 'authentication of customer mymap map crypto PARTNERAUTH' removes the current client GANYMEDE authentication +. I need to have both, until I have finished testing the radius server. Can I add a designation additional crypto map command in order to accommodate and to use both the current GANYMEDE + (ACS) and the RADIUS?

  Hello

  You need a time out to do the test.

  Kind regards

• Implementation of VLAN and QoS for VOIP on SG200-18

  We recently purchased the smart switch SG200-18 to replace a Netgear switch. We are moving our phone service to VOIP through our local ISP as well.

  I currently have the VOIP phone plugged into Port 17 on SG200-18 (it is a Grandstream Cordless VOIP phone).

  I want to put the VOIP phone on one VLAN separate from the rest of the network and optimize QoS parameters so that the VOIP phone has exceptional audio quality even during network traffic.

  Here are my questions:

  1. do I need to set anything on the type of port to Port 17 (because it resembles a shape any Combo port)?

  2. How can I do to isolate VOIP telephone it's own VLAN (I see the parameters VLANS and VLAN voice, not sure that one to use;) I've tried to set a VLAN and broke the Internet connectivity on the phone until I went and removed)?

  3. do I need to adjust the QoS settings to switch to better optimize the VOIP phone?

  Some additional questions about the GS200-18 in general:

  1. do I need to adjust the parameters of the system on the switch time? I am in the Central time.

  2. do I need to adjust the Green Ethernet/Energy Saving parameters or should I stay with the default settings?

  In addition, a couple of "getting started" questions for Cisco:

  1. I registered an account My Cisco. What should I do to register my switch with Cisco and associate with my My Cisco account?

  2. What are the benefits of purchasing a contract of Cisco Small Business support, and how much would it cost the SG200-18 (I ordered it from Provantage)? I'm curious to see if it's worth the money.

  Here's my 'features ':

  Switch: SG200-18

  VOIP phone: Grandstream DP715 and 710 handsets

  Plugged in: Port 17 on SG200-18

  Services: Internet Local (Direclynx)

  Type of connection: 3 m down / 500 k up DSL move to a future wireless connection that will give us higher speeds

  Backend VOIP provider: VOIP Innovations

  Router: Apple Airport Extreme AC model (all Macs and iOS devices and the OS X Server on the network, so I use the Apple router facilitates installation, because is not QoS, trying to QoS and VLAN in the switch)

  Thank you all!

  Hello

  I'll just go to the list again:

  1. sounds good in the port from the drop-down list. So can I just connect the VOIP phone and go with it, correct?

  Yes, just plug in ethernet combo port and it will work.

  2. is not an issue, but I agree, Apple likely isn't compatible QoS or VLAN.

  3. thanks for the info on time/NTP settings. If I wanted to go there and try to configure NTP, how much is it and what I have to do? I want to I can give it a quick try.

  To Setup NTP on the switch is quite simple.  Go to Administration > Time Settings > time system and check the boxes to activate the main clock Source (SNTP)

  Then go to the settings of the SNTP page and add a new entry with the IP address of an NTP server.  There is a list of available NTP servers here:

  http://www.pool.ntp.org/en/

  You must also ensure that the switches Administrative default gateway is set correctly (it must be set the to the default gateway, probably the most convenient airport) so the switch can contact the NTP server.  That option is set under Administration > Interface Management > Interface IPv4.  Change the user-defined default gateway and enter the IP address of your airport (or whatever your default gateway for your network)

  4 sounds good on the Green Ethernet settings. I'll leave it as default value.

  Yes, better to just let those unless you have weird problems with ports disconnect, who can sometimes be caused by Green Ethernet, but if there's nothing like leave it on and save a few watts.

  5 sounds good on does not need to attach my passage to my Cisco account. Should I fill out a form any registration of the product with Cisco before calling support?

  It is not a record for support.  The only thing we need you to do is to create a Cisco account, but you have already done this, so if/when you call in support, you just need your ID for Cisco (also called a CCOID sometimes) and the serial number of your switch.

  6. thanks for the info on the Service contract. Is it something that I would need to order directly from Cisco or I who would get my Cisco partner (Provantage)? After the three years is up, treat yourself to renewal or it just falls? Is there a certain amount of time I have to buy the Service Contract forward make me ineligible?

  Support contracts are purchased through a partner Cisco, or you can get them online for the CDW or Newegg for example.  Basically, you have until the expiry of your current aid for the purchase of a new contract.  For example, right now your switch comes with 1 year of technical support.  You can only buy a contract while it is still active.  Once your three-year contract is about to run out, you're in the same situation.  You can renew it before it expires, however if you leave is up, you will not be able to put a contract on it.  Contracts are not my specialty, however, so you can check with your partner for complete details.

  7. sounds good to how data use VOIP calls. His dislikes too. :-)

  I agree, a voice call is not much traffic.  What you have described you probably don't have problems, although of course I can't guarantee that.

  8. because it is from your provider and they specifically mentioned the VOIP, I would say that you'll be fine here.

  You had also placed on your airport using access point behind a router in small businesses.  I would like to say that it is possible, a large number of wireless routers have an option to put access point only mode or something like that, but you should check with Apple on how to do it.

  Insofar as a Small Business router if you decide to upgrade for the options VLAN or QoS, I would recommend the RV180, or perhaps the RV320.  Two of these models are available with or without wire depending on what you decide to do with the airport.

  I think I got all the questions, but if not just let me know,

  Christopher Ebert - Network Support Engineer

  Cisco Small Business Support Center

  * Please note the useful messages *.

• Firewall PIX boots to halfway and crashes

  I have a problem with my 525. PIX, it begins to start and then hangs at this task forever.m do not know whether or not its an ios issue

  CISCO PIX FIREWALL SYSTEMS
  BIOS version shipped 4.3.207 01/02/02 16:12:22.73
  Compiled by Manu
  256 MB OF RAM

  PCI device table.
  Bus Dev Func VendID DevID class Irq
  00 00 00 8086 7192 host Bridge
  00 07 00 8086 7110 ISA Bridge
  00 07 01 8086 7111 IDE controller
  00 07 02 8086 7112 bus Series 9
  00 07 03 8086 7113 PCI Bridge
  00 0D 00 8086 1209 Ethernet 11
  0E 00 00 8086 1209 Ethernet 10
  00 11 00 14E4 5823 co-processor 11
  00 13 00 8086 PCI bridge to PCI B154
  01 04 00 8086 1229 Ethernet 11
  01 05 00 8086 1229 Ethernet 10
  01 07 00 8086 1229 Ethernet 5

  Cisco Secure PIX Firewall (4.2) BIOS #0: Mon Dec 31 08:34:35 PST 2001
  Platform PIX-525
  System Flash = E28F128J3 @ 0xfff00000

  Use BREAK or ESC to interrupt flash boot.
  Use the SPACE to start boot flash immediately.
  Read 102912 bytes of the image of the flash.

  PIX Flash charge assistance

  Initialization of flashfs...
  flashfs [0]: 7 files, 3 folders
  flashfs [0]: 0 orphaned files, orphaned directories 0
  flashfs [0]: Total number of bytes: 16128000
  flashfs [0]: bytes used: 13952512
  flashfs [0]: available bytes: 2175488
  flashfs [0]: initialization complete.

  Start the first image in flash

  Launch of flash image: / image
  ################################################################################
  ################################################################################
  ################################################################################
  ################################################################################
  ################################################################################
  ################################################################################
  ##############
  256 MB OF RAM

  Total network cards found: 5
  mcwa i82559 Ethernet on irq 10 MAC: 001a.a2a4.4dc2
  mcwa i82559 Ethernet to irq 11 MAC: 001a.a2a4.4dc3

  Looks more like a hardware problem with a PCI bus or ethernet card 4 ports.

  Well I guess you have a card ethernet 4 ports, so 6 ports in total, but the device is only to see 5.

  It seems that peripheral 06 is missing on bus 01 so one of the ports on the card 4 ports is not recognized.

  Does it boot ok if you remove that card?
  
  

  HTH

  Herbert

• UCS and QoS

  Hello:

  The ecosystem of the UCS relies on a solution of aggregation of port to the i/o chassis, namely, FEX modules.

  The FEX modules are not fully featured switches. Nor do they have a political intelligence transfer at all. Instead, the FEX modules deploy approach "pinned" in which the descenders (those facing NIC in the Server Blade, LOM, mezzanine cards) are mapped to an uplink port (those who face a 6100 Interconnect fabric) to form what can be described as a group of aggregator.

  The result is a simplified approach to blade i/o in which traffic patterns are predictable and failover is deterministic. In addition, there is no need to configure STP because ports are sent in order to exclude any possibility of a loop connection.

  This having been said, there is some merit to the argument that this port aggregation design places a hole in the middle of a deployment of QoS for the scheduling of packets on the uplink to the 6100 of interconnection fabric ports is not done in a way that recognizes the priority?

  In order to develop a little more, one can have a VMware deployment and use NetIOC or maybe configure QoS on a 1000v switch (which uplink ports are mapped to a port on the VIC de Palo) and configure QoS on the VIC and then the 6100 Interconnect fabric. But, given that the FEX is not planning for traffic to the 6100 interconnection fabric on a priority basis, the deployment of QoS has a hole in the Middle, so to speak.

  Thoughts?

  Hello

  I posted an answer to your question here:

  http://bradhedlund.com/2010/12/08/Cisco-UCS-fabric-Extender-FEX-QoS/

  I hope this helps.

  See you soon,.

  Brad

• Routers RV: personalized Services and QoS

  I have a few questions about the addition of personalized services and their use in QoS for RV routers (I use the RV220W)

  Suppose I have create a personalized as:

  Name: MyService

  Port: TCP 60000

  1 this port number is the port number used by my computer on the local network or the port number on the other side for example a computer on the Internet, I use this service to connect to? Some services use the same port number on the side that starts the service and the receiving end, but there are services that use different ports for the end of the initiator and receiver. So what is the significance of the port number when creating a custom service?

  Computer in the local network: (port TCP 60000) <---->Internet computer: (some the TCP port, not necessarily 60000)

  -or-

  Computer in the local network: (some the TCP port, not necessarily 60000) <---->Internet computer: (port TCP 60000)?

  2 suppose I have create a binding configuration of QoS profile for this service customized to a specific IP address on my local network. QoS is only applied on the outgoing network traffic. How will work this profile?

  A. applied to traffic from my LAN device with the IP address and the port TCP 60000

  -or-

  B. applied to traffic from my LAN device with the IP address specified to the port of the computer another TCP 60000?

  Thanks in advance

  Sent by Cisco Support technique iPad App

  Panos, it should be your example.

  -Tom

• Problems with VPN between Cisco PIX 6.3.3 and VPN 3000 Concentrator

  Hi guys,.

  I hope this is the right place and that someone has encountered this before I don't have much hair left to offset - I'm trying to set up a tunnel between our Pix 6.3.3 performer and a customer using a VPN3000.

  The customer wants us to be able to do checkups on a device without allowing anything to of our range of addresses network side private, just one public IP address.  We currently run a VPN to our recovery site to allow off-site replication, but the ACL on the other end of this VPN * does * allow the configuration that we had for our private network side, so traffic was not useful at that.  Here is a screenshot of what I tried:

  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  nameif ethernet2 dmz1 security50

  name 172.16.1.48 Cust_DVR1

  permit 192.168.1.0 ip access list inside_outbound_nat0_acl 255.255.255.0 255.255.255.255 Cust_DVR1

  permit 192.168.1.0 ip access list outside_cryptomap_30 255.255.255.0 255.255.255.255 Cust_DVR1

  IP outside X.Y.Z.227 255.255.255.224
  IP address inside 192.168.1.1 255.255.255.0

  location of PDM Cust_DVR1 255.255.255.255 outside

  Global 1 X.Y.Z.230 (outside)
  Global (dmz1) 1 interface
  NAT (inside) 0-list of access inside_outbound_nat0_acl
  NAT (inside) 1 192.168.1.0 255.255.255.0 0 0

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  outside_map 30 ipsec-isakmp crypto map

  outside_map 30 peer A.B.C.D crypto card game<--- (public="" ip="" of="" customer="">

  card crypto outside_map 30 match address centura_map_30

  card crypto outside_map 30 the transform-set ESP-3DES-MD5 value

  outside_map interface card crypto outside

  ISAKMP key * A.B.C.D netmask 255.255.255.255 No.-xauth No. config-mode

  part of pre authentication ISAKMP policy 30

  ISAKMP policy 30 3des encryption

  ISAKMP policy 30 md5 hash

  30 2 ISAKMP policy group

  ISAKMP duration strategy of life 30 86400

  My hope is that anything on the 192.168.1.0/24 would be able to get out of the external interface as our only our public IP addresses (i.e. X.Y.Z.230), but the traffic they see on the other end is coming from the 192.168.1.0 network.  I tried to remove the line inside_outbound_nat0_acl think she would use then the world but still do not have a bit of luck and the only difference I see on Kiwi Syslogd is that the src_proxy changes to 0.0.0.0 where is shows the IP address of my private side (for the purposes of the config above let's call it 192.168.1.135).

  THANKS MUCH FOR ANY HELP!

  -Mario

  Hello

  For example, you can NAT your internal via the tunnel network traffic when you go to this customer.

  In this way, they will see your unique internal network as an IP address.

  Let's say, rather than them seeing your internal 192.168.1.0/24, eelle will see your traffic like X.Y.Z.227

  Is this what you need?

  Federico.

• PIX site to site and remote access

  Dear guy

  I have a PIX 515e with version 8.0 and the other side a 2811 router, the vpn site to site between these two devices is implemented, but I want some remote clients can connect to pix,.

  so is this possibe two implement a site to access remote vpn on pix interface (outside)?

  any clue?

  Hello

  Yes, it is quite possible. Please see attached the sample configuration. Note This is for pix v7.x, but it should work fine for 8.x

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00807f9a89.shtml

  HTH

  Jon

• PIX 515 (7.02) and the translation of static port

  Just try to transfer a foreign port int-> device sitting on 'inside' Interface, but do what following in the logs:

  % 106006-2-PIX: Deny UDP incoming from 66.21.215.238/50507 to client_routable_address/6881 on the interface outside

  % 106006-2-PIX: Deny UDP incoming from 62.141.54.206/6881 to client_routable_address/6881 on the interface outside

  % 106006-2-PIX: Deny UDP incoming from 84.217.31.157/6881 to client_routable_address/6881 on the interface outside

  The Config:

  access-list 101 extended permit icmp any any echo response

  access-list 101 extended permit icmp any any source-quench

  access-list 101 extended allow all unreachable icmp

  access-list 101 extended permit icmp any one time exceed

  access-list 101 extended permit tcp any host client_routable_address eq 6881

  access-list 101 extended permit udp any host client_routable_address eq 6881

  Global (outside) 3 client_routable_address

  NAT (BCM) 3 0.0.0.0 0.0.0.0

  static (BCM, outside) 192.168.20.10 tcp 6881 6881 netmask 255.255.255.255 client_routable_address

  static (BCM, outside) udp 192.168.20.10 6881 6881 netmask 255.255.255.255 client_routable_address

  Access-group 101 in external interface

  Static translations are there at the "show xlate:

  # sh xlate

  50 in use, most used 957

  Client_routable_address (6881) Local 192.168.20.10 (6881) Global PAT

  Client_routable_address (6881) Local 192.168.20.10 (6881) Global PAT

  ACL 101 "6881" entries are not to get hit if:

  # See the access list 101

  access list 101; 7 elements

  allowed for line 101 1 extended icmp access list any entire echo response (hitcnt = 0)

  line of the access list 101 permit extended 2 icmp any any source-quench (hitcnt = 10)

  extended all licences for line 101 3 access list all unreachable icmp (hitcnt = 10279)

  line 4 extended access list 101 allow icmp all a time exceeded (hitcnt = 265)

  allowed for line of the access list 101 5 scope tcp any host client_routable_address eq 6881 (hitcnt = 0)

  allowed for line in the list of 101 6 extended access udp any host client_routable_address eq 6881 (hitcnt = 0)

  Am I missing something obvious?

  Hello

  I think you've got your STATIC reversed lines, they must be:

  static (BCM, external) client_routable_address tcp 6881 192.168.20.10 6881 netmask 255.255.255.255

  Assuming that 'client_routable_address' is your public IP and the BMC is your 'inside' or the 'DMZ' interface

  Salem.

• Pix 501 license limits and how to say

  I sent a PIX-501-BUN-K9, which is limited to 10 users. I recently sent another PC. I can't browse the internet unless I reboot the pix. Is this an indication that I need to update the license?

  What commands can I run on the pix to check or validate that I reached the limit license?

  You can enter:

  SH ver

  or

  SH - activation key

  This will display your license that is installed on your PIX. Next to "To inside hosts", you will see how many user licenses are available. You can upgrade by purchasing a license from 10 to 50 users (PIX-501-SW-10-50 =) for about $240, or 10 to unlimited (PIX-501-SW-10-UL =) for about $370.

  To find out how many are currently in use, you can enter "sho xlate count" which will set out how current translations are used.

  Please rate if this can help.

• PIX version 6.3 and static priority

  Hi all

  This question concerns do differnet kinds of static on a pix6.3 (4).

  I have a setup where I need static nat public IP address on a mail server on the network private.

  It works very well. Now, I also want to expose the inside of the network to the public side (as shown in the example config)

  inside the ip 192.168.1.x

  Apart from the ip 55.55.44.x

  public static 55.55.44.33 (Interior, exterior) 192.168.1.10 netmask 255.255.255.255 0 0<- mail="">

  static (inside, outside) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0

  Now... the mail server-specific static will resume precende the translation of net-to-net?

  Kind regards

  Hey Kevin,

  Too much honing ip can be solved by leaving the 192.168.1.0/24 network at the end of the static instructions. When a packet arrives at the external interface, the pix treats all the static instructions from top to bottom. Because the mail server is configured before the net NET, this statement will be precende. (for code 6.3)

  Mike

  Mike