Session of top through PIX 515E firewall
My ISP is stopping the internet service and told that I have a number of great session of 5400 +... The normal session counts should be around 200. Due to this high number, my site may potentially adversely affect my network and their network. They disabled this site in order to prevent any damage.
MY PIX config is attached, please check.
Note: the modem from my ISP have IP 216.147.153.113/29
If you have any questions please contact me via Email or messenger below contacts, I appreciate your help in advance.
Thank you
Latitia K. Carlson
Iraq - Baghdad
Mobile phone: + 964 7901 762691
[Yahoo ID: mailto:[email protected] / * /">[email protected] / * / .
[MSN ID: mailto:[email protected] / * /">[email protected] / * / .
[Email: mailto:[email protected] / * /">[email protected] / * / .
Hi Sam,
seen configs... Why are you opening an entire ip and tcp everything everything inside and outside... first remove these instructions and then see the performance... am sure most useless traffic go through now because of these statements...
No inside_access_in of the ip access list allow a whole
No inside_access_in access list do not allow a full tcp
see if this has solved the problem.otherwise he must refine the remaining access lists... Make sure that all ports are open, after you remove those 2 lines...
REDA
Tags: Cisco Security
Similar Questions
-
Asst Req config for pix 515e firewall
Hello
I'm configring as the Pix for the first time & I am little confused with Nat Pat & I want to use pat in my n/w & I Web server I want to leave out.
The one you suggest how can I achieve this configuration & any document on Pix & Nat will be a great help.
Thank you & direct them
Kumar
first thing first, I guess the pat is used for the inside of the host to navigate on the internet:
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
as for inbound access to the Web server, it depends how many public ip address is available. If one only, you can set up port forwarding. whereas there are several public ip address, you can configure 1-to-1 NAT.
for a public ip address,.
public static tcp (indoor, outdoor) 80 80 netmask 255.255.255.255 interface
list of allowed inbound tcp access any interface outside eq 80
Access-group interface incoming outside
for several public ip address,.
static (inside, outside) subnet mask 255.255.255.255
list of allowed inbound tcp access any eq 80
Access-group interface incoming outside
-
I have two PIX 515E firewall v7.01 configured in a failover scenario.
The two units were operating without problem. Primary worked very well and the configuration changes have been transferred to secondary school.
By TAC support, the only thing needed to test the failover was to issue a command to 'reload' in the primary and the secondary, take on main. Then, "active failover" question on the once rebooted device it was up in the secondary role.
Failover to the secondary unit worked without problem, it is a smooth transition to the secondary unit.
The problem came in that the original primary unit is stuck in a loop when you try to reload with what looks like now configuration errors. It will not properly start upward.
Is not a valid procedure to test the failover?
It seems that in the real world, this could actually happen that failover should work?
Among what is shown:
Config ERROR: invalid journal / level
keyword specified; level must be emergencies (0) - debugging (7) Config error - acl_in list extended access permit tcp any newspaper SMTP host 208.13.32.36 eq
Out of config line 359, "access-list acl_in exten...". »
Config sync error: Suite not command could be executed in standby mode
Platform
acl_in list access permit tcp any host 208.13.32.36 eq smtp log inactive
Use BREAK or ESC to interrupt boot.ridge/vlan/modify flash): m
e inactivea VLAN
REPLICATION OF CONFIGURATION OF ACTIVE TOWARDS THE RESCUE UNIT IS INCOMPLETE,
Reading of 115200 bytes of the image of the flash.
TO AVOID THE EVE OF TAKING OVER AS ACTIVE WITH A PARTIAL CONFIGURATION UNIT, THE EMERGENCY UNIT WILL NOW RESTART *.
You're not going to like this answer.
It seems that commands typed in and abstract by cisco in the configuration are not valid when copied/pasted in or when the firewall is rebooted or receives an active firewall configuration.
I don't know exactly what you did, but here's what I did to reproduce your problem:
I typed in the command:
acl_in list access permit tcp any host 208.13.32.36 eq smtp interval 300 inactive information newspaper
Given that "interval 300 ft newspaper is the default, it is actually saved in the running-config like:"
acl_in list access permit tcp any host 208.13.32.36 eq smtp log inactive
It's * not * a command invalid (the word "journal" following address must be a logging level), if you try to kick it. When you restarted the firewall, he tried to shoot the active configuration of the device (because it is now pending), received this line and since he can't run it (because it is not a valid command), it keeps restarting itself so that it cannot take over and be the active firewall.
Best way to do is to hold this line (and other lines like him) outside the firewall active now - the line is marked "inactive" in any case, this should not affect you. The other way would be to change that line to something by default (the recording level change may be easier). In this way when the primary/secondary itself restarts again, the order received will have a valid log level (or if you take the lines out, they will not be a problem) and will allow the rest of the configuration process.
You can also report to cisco as a bug, if they are not combing these forums already.
-Jason
This rate if this can help.
-
We have a PIX 515E firewall and the SMTP banner is changed to 220 *.
I need to disable this and I can't use the command "no fixup protocol SMTP" as it is not present in 7.1.
Any suggestions?
Kind regards
Keyvan
This is done under the map class 'class-map inspection_default' in this version of the PIX OS.
pls rate if useful!
-
Cisco VPN Client behind PIX 515E,->; VPN concentrator
I'm trying to configure a client as follows:
The user is running Cisco VPN Client 4.0. They are behind a 6.1 PIX 515E (4), and I need to connect to a VPN concentrator located outside of our network. We use PAT for address translation. As far as I know, to allow ipsec through Firewall 1 tunnel, I need to upgrade the pix to 6.3 and activate "fixup protocol esp-ike.
Is there another way to do this? I am also curious to know how much more easy/better this will work if we were dealing with pptp.
You don't necessarily need to fixup protocol esp-ike active. The remote Hub there encapsulation NAT - T enabled so that clients behind the NAT can run?
-
PIX 515E->; URL filtering: enabled
Hello
When I start my Cisco PIX 515E, I can see this output:
Cisco PIX Firewall Version 6.3 (3)
Features licensed:
Failover: disabled
VPN - A: enabled
VPN-3DES-AES: disabled
The maximum physical Interfaces: 3
Maximum Interfaces: 5
Cut - through Proxy: enabled
Guardians: enabled
URL filtering: enabled
Internal hosts: unlimited
Throughput: unlimited
Peer IKE: unlimited
I understand everything except "URL filtering: enabled".
I looked in the documentation, but I can't find an explanation: is the PIX can filter requests for URL?
Thank you in advance for the answer.
Paolo
Hi Paolo,.
6.3 IOS PIX supports filtering of HTTPS and FTP sites to websense filtering servers, this option is enabled by default.
More information can be found here:
http://www.Cisco.com/en/us/products/sw/secursw/ps2120/prod_release_note09186a00801a6d21.html
and here:
Hope this helps-
Jay
-
Hi all
We just bought a PIX 515E and try to use it, but got a number of questions. Here's the NVA of show:
PIX-151st #show version
Cisco PIX Firewall Version 6.3 (1)
Cisco PIX Device Manager Version 3.0 (1)
Updated Thursday 19 March 03 11:49 by Manu
PIX-515E up to 5 hours and 15 minutes
Material: PIX-515E, 64 MB RAM, Pentium II 433 MHz processor
Flash E28F128J3 @ 0 x 300, 16 MB
BIOS Flash AM29F400B @ 0xfffd8000, 32 KB
0: ethernet0: the address is 000f.2457.4b12, irq 10
1: ethernet1: the address is 000f.2457.4b13, irq 11
Features licensed:
Failover: enabled
VPN - A: enabled
VPN-3DES-AES: enabled
Maximum Interfaces: 6
Cut - through Proxy: enabled
Guardians: enabled
URL filtering: enabled
Internal hosts: unlimited
Flow: IKE peers unlimited: unlimited
This PIX has a failover license only (FO).
Problem is that we cannot ping inner harbor, if we do not switch light, but this is a unique machine. Here's another message once we turn on the switch:
PIX-515E # config t
WARNING *.
Configuration of replication is NOT performed the unit from standby to Active unit.
Configurations are no longer synchronized.
PIX-515e (config) #.
Please help solve this problem. I wonder if we buy the wrong license? Thank you very much.
you have in your possession a PIX failover. That's why says in the "sh run".
This device is intended to be used only as a failover for a live device. It will work as a live PIX, but behave badly. It is cheaper than a PIX with an unrestricted license, as it is not intended to be used as a standalone device. Check with the one that you bought to get the situation sorted.
Good luck
Steve
-
Hello
I have pix 515E and I configured a VPN on it. My users connect to my network from the internet via the Cisco VPN client.
I have problem, only their LAN machine can do VPN from Cisco VPN client to my network at once.
Users are connected to the internet via an ADSL router and the LAN switch.
--------------------------------------------------
PIX Config:
6.3 (4) version PIX
interface ethernet0 car
Auto interface ethernet1
ethernet0 nameif outside security0
nameif ethernet1 inside the security100
enable encrypted password xxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxx encrypted passwd
hostname ABCDEFGH
ABCD.com domain name
clock timezone IS - 5
clock to summer time EDT recurring
fixup protocol dns-length maximum 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol 2000 skinny
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
inside_out to the list of allowed access nat0_acl ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
list of allowed shared access ip 192.168.1.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
Outside 1500 MTU
Within 1500 MTU
IP address outside xxx.xxx.xxx.xxx 255.255.255.0
IP address inside 192.168.1.1 255.255.255.0
alarm action IP verification of information
alarm action attack IP audit
IP local pool vpnpool 192.168.2.1 - 192.168.2.254
PDM logging 100 information
history of PDM activate
ARP timeout 14400
Global interface 10 (external)
NAT (inside) 0-list of access inside_out-nat0_acl
NAT (inside) 10 0.0.0.0 0.0.0.0 0 0
Route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
Timeout, uauth 0:05:00 absolute
GANYMEDE + Protocol Ganymede + AAA-server
AAA-server GANYMEDE + 3 max-failed-attempts
AAA-server GANYMEDE + deadtime 10
RADIUS Protocol RADIUS AAA server
AAA-server RADIUS 3 max-failed-attempts
AAA-RADIUS deadtime 10 Server
AAA-server RADIUS (inside) host ABCDE timeout 10
AAA-server local LOCAL Protocol
RADIUS protocol radius AAA-server
Radius max-failed-attempts 3 AAA-server
AAA-radius deadtime 10 Server
RADIUS protocol AAA-server partnerauth
AAA-server partnerauth max-failed-attempts 3
AAA-server deadtime 10 partnerauth
partnerauth AAA-server (host ABCDEFG myvpn1 timeout 10 Interior)
Enable http server
http 192.168.1.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
SNMP-Server Community public
No trap to activate snmp Server
enable floodguard
Permitted connection ipsec sysopt
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto-map dynamic outside_dyn_map 20 the transform-set ESP-3DES-MD5 value
map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
card crypto client outside_map of authentication partnerauth
outside_map interface card crypto outside
ISAKMP allows outside
ISAKMP key * address 0.0.0.0 netmask 0.0.0.0
ISAKMP identity address
part of pre authentication ISAKMP policy 8
ISAKMP strategy 8 3des encryption
ISAKMP strategy 8 md5 hash
8 2 ISAKMP policy group
ISAKMP life duration strategy 8 the 86400
part of pre authentication ISAKMP policy 10
ISAKMP policy 10 3des encryption
ISAKMP policy 10 sha hash
10 2 ISAKMP policy group
ISAKMP life duration strategy 10 86400
vpngroup myvpn address vpnpool pool
vpngroup myvpn ABCDE dns server
vpngroup myvpn by default-field ABCD.com
splitting myvpn vpngroup split tunnel
vpngroup idle 1800 myvpn-time
vpngroup myvpn password *.
Telnet 192.168.1.0 255.255.255.0 inside
Telnet timeout 5
SSH timeout 5
Console timeout 0
dhcpd address 192.168.1.200 - 192.168.1.254 inside
dhcpd dns ABCDE
dhcpd lease 3600
dhcpd ping_timeout 750
field of dhcpd ABCD.com
dhcpd outside auto_config
dhcpd allow inside
Terminal width 80
--------------------------------------------------
Thanks in advance.
-Amit
Try to add the "isakmp nat-traversal" command to your PIX. I suspect what happens is that Remote LAN users is translated to a single IP address as they pass through the DSL connection. I also assume that the machine doing the translation has a capacity of IPSec passthrough. Linksys routers would be a good example of this type of NAT device that allows IPSec pull-out.
If that's the case, that a single VPN connection will be able to operate both. The above command will turn PIX detect clients that are located behind a NAT device, and then try to configure the VPN sessions in UDP packets and so to work around the limitation of NAT and IPSec passthrough device.
-
When I use ASDM to administer my PIX-515E (v7.0), I get messages from 2 following error if I update the screen after being inactive in the session for about 2-3 minutes about:
Error message 1
ASDM is temporarily unable to communicate with the firewall.
Error message 2
ASDM is unable to reach the PIX. Please check the configuration and your connection and try again by clicking the Refresh button.
These messages were recently and I don't know why. Is there an ASDM idle session time-out setting? I could not found.
Thank you
Bill Fanning
Hello
What version of Java are you using. If you have Java 1.6, can you go back to 1.5 and see if the problem goes away.
Also, here is the URL indicating the operating system for client PC and browser requirements
http://www.Cisco.com/en/us/partner/docs/security/ASA/asa70/asdm50/release/notes/RN505.html#wp231810
I hope it helps.
Kind regards
Arul
* Please note all useful messages *.
-
I am installing a PIX 515e with an ADSL router. I have all the IP addresses for the router etc. I'm trying to connect to a network on the interface internal of the PIX. (Please bare with me as I am new on the firewall!)
I ping the network firewall, but I can not access to the internet. The initial configuration for the PIX documentation implies that by default, it has access form the firewall but no! I'm obviously missing something here, i.e. of Thompson the network to route requests through the firewall interent! ???
Sorry to be so simplistic but I'm learning all the time!
Thanks for any help.
Robin
After you enter the acl to allow ping, can you ping now?
Watch newspaper reveal something?
For DNS and testing, create a static on the PIX for your DNS server. For example "x.x.x.x (indoor, outdoor) static 192.168.0.x netmask 255.255.255.255" where x.x.x.x is a public IP address and 192.168.0.x is your dns server. Then let the outside to your DNS server dns - "access-list 101 permit host udp/tcp host x.x.x.x eq 53 z.z.z.z ' where z.z.z.z is a public dns server (or use one for testing) and x.x.x.x IP NAT'ed to your dns server. See what is happening, look in your journal.
What version of PIX you run.
Let know use.
Steve
-
Cannot ping PIX 515e Interfaces
I know it's a very silly question for this forum, but I have already tried many things and cannot get the answer from the PIX firewall interfaces.
It's my (very easy) installation:
Using a FastEthernet port on router, I have a cable connected directly to the outside I / F of the PIX-515e. (Crossover cable works, I have already tested). Router <-->PIX directly connected.
I configured the PIX firewall to allow pings (I used different commands):
ICMP allow any response of echo outdoors
ICMP allow all outside
ICMP permitted
- echo outside response I tried to configure each of them and also combined.
Also tried to send the PIX to its default values. Supposed to be after that the PIX should allow all pings if no "icmp" command is configured.
I have configured the ports on both sides to 100 Full
On both sides of the link (PIX and router) I have the links to the top. The lights are on.
The 'show interest' on the PIX firewall shows to the top/top
The same thing on the router...
The two interfaces are configured in
10.1.1.0/24 (10.1.1.1 & 10.1.1.2)
What I am doing wrong?
This should be very easy...
Hello
Majority of the time interfaces refuses explicitly to ICMP packets unless you indicate otherwise. Here is a link to a pretty good setup guide... Have a look at the link to the ping Security Appliance Interfaces section in this guide. I'm really frustrated myself during the installation/testing phase because the pings are not working and it helped. Hope this helps a little and makes your life easier =) (rate if it please and thank you)
Thank you
Chris
-
License - PIX 515E, restricted or unrestricted?
How can I know what license I have on a PIX515E? I need to know if it is limited or unlimited. Here is the output of sh worm but nothing jumps on me and said: that which.
Cisco PIX Firewall Version 6.2 (2)
Cisco PIX Device Manager Version 1.1 (2)
Updated Saturday, June 7 02 17:49 by Manu
ABC-FW01 up to 3 hours and 24 minutes
Material: PIX-515E, 32 MB RAM, Pentium II 433 MHz processor
Flash E28F128J3 @ 0 x 300, 16 MB
BIOS Flash AM29F400B @ 0xfffd8000, 32 KB
0: ethernet0: the address is 000a.b7bc.4b30, irq 10
1: ethernet1: the address is 000a.b7bc.4b31, irq 11
2: ethernet2: the address is 0002.b3ad.8176, irq 11
Features licensed:
Failover: enabled
VPN - A: enabled
VPN-3DES: disabled
Maximum Interfaces: 6
Cut - through Proxy: enabled
Guardians: enabled
URL filtering: enabled
Internal hosts: unlimited
Throughput: unlimited
Peer IKE: unlimited
Serial number: 806343913 (0x300fd4e9)
Activation key running: xxxx
Modified configuration of enable_15 to 10:26:27.064 UTC Tuesday, February 7, 2006
It is an unrestricted license. The number of maximum interfaces is a way of saying. Restricted is only 3 where UR is 6. You can use this page to see other differences.
http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_data_sheet09186a00800b0d85.html
You could also paste your show in output interpreter tool version, if you are a registered user.
Steve
-
I got some new PIX 515E security infra-red and I had sex 2 questions about everything I tried. I installed a 5 port switch inside and cannot ping anything from the console. I have a computer on the switch, and he is able to ping other devices on the switch, but not the PIX.
What I find strange is that when I try to ping from the inside interface on the PIX of one inside computers, PIX displays the MAC address of the computer inside in the arp table.
My goal is to upgrade the PIX to ver7.0 but I can't do so until I can solve this problem.
Here are some information among the PIX.
#sh worm
Cisco PIX Firewall Version 6.3 (4)
Cisco PIX Device Manager Version 3.0 (2)
Updated Saturday 2 July 04 00:07 by Manu
pixfirewall up to 29 minutes 33 seconds
Material: PIX-515E, 128 MB RAM, Pentium II 433 MHz processor
Flash E28F128J3 @ 0 x 300, 16 MB
BIOS Flash AM29F400B @ 0xfffd8000, 32 KB
Hardware encryption device: VAC + (Crypto5823 revision 0 x 1)
0: ethernet0: the address is 0015.625a.f7da, irq 10
1: ethernet1: the address is 0015.625a.f7db, irq 11
2: ethernet2: the address is 000d.8810.902c, irq 11
3: ethernet3: the address is 000d.8810.902d, irq 10
4: ethernet4: the address is 000d.8810.902e, irq 9
5: ethernet5: the address is 000d.8810.902f, irq 5
Features licensed:
Failover: enabled
VPN - A: enabled
VPN-3DES-AES: disabled
The maximum physical Interfaces: 6
Maximum Interfaces: 10
Cut - through Proxy: enabled
Guardians: enabled
URL filtering: enabled
Internal hosts: unlimited
Throughput: unlimited
Peer IKE: unlimited
This PIX has a failover license only (FO).
#sh run
interface ethernet1 100full
nameif ethernet1 inside the security100
pixfirewall hostname
domain testlan
access-list acl_out permit icmp any one
No external ip address
IP address inside 192.168.1.222 255.255.255.0
No IP failover outdoors
No IP failover inside
#sh int e1
interface ethernet1 'inside' is up, line protocol is up
The material is i82559 ethernet, the address is 0015.625a.f7db
IP 192.168.1.222, subnet mask 255.255.255.0
MTU 1500 bytes, BW 100000 Kbit full duplex
Hi M8,
Your firewall has a license of FO, you must enable this device to be able to see it.
Run the command:
active failover
With this command, the device turns into the 'Active' from a perspective of failover state. It will work after that.
See you soon.
Salem.
-
4240 IPS blocking queries with Pix 515E
I have activated the lock on the 4240 and put locking as our Pix 515E. When I look at the Configurations of Signature quite a few Signature Actions are set to alert only produce. If blocking is enabled you also go and the Actions of signing the Deny value or TCP Reset? So far my attackers show dosen't IPS refused and he detected the high level of traffic which I assume must now be blocked. Thanks John
Yes, go under the signatures that you want and enable blocking for them as an action. Globally blocking configuration (setting the blocking device, the interface, the connection of the device information, etc.), does not actually blocked on the sensor itself, we must still go and activate the blocking of this particular signature. When this particular GIS fires in the future, the sensor it will block on the device that you configured.
Be very careful with blocking, the reason that we're not blocking simply all the signatures, it is that it would be very dangerous to blindly add access lists to a device that will stop traffic. You must first make sure that you don't get any number of false positives on the signatures and end up blocking valid traffic. In addition, on a busy sensor you could easily overrun detector and locking to writing and deleting 1000's of top access lists. And finally, although probably not, blocking can even be used as an attack denial of service, where an attacker, if they know what signatures you block, can usurp packages past your sensor so that it denies traffic to our legitimate guests.
You have to look at what signatures you really want to block, and then enable blocking on them individually.
-
Cisco VPN Client Authentication - PIX 515E-UR
Hi all
I need your expert help on the following issues I have:
1. I would like to create more than 1 client VPN on my PIX-515E groups. This is so that I can give a different part of the internal network access to different type of VPN connection. For example, I want a group to have no XAUTH, while the other group must use RADIUS XAUTH. Is it possible for me to do this? I see the PIX automatically enable RADIUS on both groups of VPN clients.
2. the RADIUS server is a Microsoft ISA with IAS server and it is located on the PIX inside interface. The VPN endpoint is external interface of the PIX. Is there a problem with this Setup? Do I need to have the RADIUS server that is located on the external interface?
3 can. what command I use to debug RADIUS authentication?
Thanks in advance for your help.
Hi vincent,.
(1) you can use the vpngroup *-authentication server ipaddress to specify the IP address of the Radius Server on a particular group... If you do not specify this, the authentication of the user is made locally... also check for vpngroup * order of user authentication
(2) there should be no problem with the installation of your... should work fine... If the RADIUS is outdoors, it is subject to many attacks... so have it inside...
(3) use the "RADIUS session debug" or "debug aaa authentication..."
I hope this helps... all the best... the rate of responses if found useful
REDA
Maybe you are looking for
-
Red inalámbrica coneccion config for IP nullified
No puedo conectarme an internet inalambricamente tengo este mensage "coneccion inalámbrica config for IP nullified" red comopuedo corregir este problema
-
HP4630: Fax... .cannot receive.
I'm unable to receive faxes. Help, please.
-
Problems with a black screen at startup.
It may take up to 30 minutes for my monitor display my desktop screen. I have a message that says that the NVIDIA Compatible Windows Vista Kernel Mode Driver version 175.78, windows to resume slowly. This could be my problem and if so how should I
-
elockplugin that this need for now
that this need for now
-
My account is "temporarily blocked... now more than two weeks.
My account with hotmail (approx. 14 years I think) has been temporarily blocked... about 3 weeks ago... I don't have any large shipments or anything out of the ordinary. The account in question is (obviously NOT this one...) is * address email is rem