Simple question PIX 501

Similar Questions

• Simple question PIX

  Hello

  It's been a while since I've done work with a PIX and as such I am a little rusty with them. I wonder if someone who is a little more familiar with them my being able to answer my question.

  We have a 24 block of public IP addresses that are currently used for various Linux servers + AS5300. I prefer to keep it as a solid with subnets block it.

  We have a number of Windows 2000 servers that are running different PSTN switching + applications SQL that will be installed on the same network. I don't want to put these on the public internet any security guards are taken on local machines. Fortunately, we have a PIX 515 going spare.

  Is it possible to individual/block of IP addresses to the external interface inside card interface of the pix as opposed to a block of addresses for routing on the interface inside of our net block or perform a static mapping from the public to the private. I'm after the result for servers behind the PIX have a public IP address that is flowing through the PIX. So indeed the PIX would act as a bridge firewall. This type of installation is possible?

  Kind regards

  Alan

  Alan,

  Yes. I would * hopefully * is to group machines that keep their outside global addresses together so that I could create an access list to cover.

  i.e.

  access-list ip 10.10.10.0 sheep allow 255.255.255.224

  (Outside) NAT 0 access-list sheep

  This allows the 32 first-(2) IP addresses through the firewall with no address translation.

  You can also restrict the types of traffic as well. My suggestion is to keep the traffic flow and filtering of the traffic of the separate lists. So if I have a Web server in the subnet mentioned above, I would write the following:

  list of allowed incoming access tcp 10.10.10.3 255.255.255.255 eq www

  Hope this helps,

  Doug.

• PIX 501 PPPoE w / static NAT loss of connectivity

  I have a {should} installation very simple. PIX 501 with PPPoE on the external interface, 3 inside customers using PAT and 1 inside the client I am trying to use an address mapping static on permit communications with this host from the outside using a particular service. I did a lot of these before where there was an ADSL router in front of the PIX, but this is the first where I've used the PIX as the PPPoE client. When I use the static NAT for the single host it loses all connectivity beyond the PIX outside interface. When I get rid of the static mapping, through PAT very well. I spent many hours troubleshooting and control a lot of obvious things, but I am at a loss right now... unless it could be a problem with the IP address that has been assigned by the ISP for use with static NAT. Any thoughts on this would be greatly appreciated.

  Thank you

  Sorry, in your case that static would look like this because of the dynamic IP.

  static (inside, outside) 23 interface 10.1.1.1 23 netmask 255.255.255.255

  Daniel

• PIX 501 question?

  Hello

  I have a PIX 501 and received 1 single public IP address from my ISP and I need to access a server on the private network of outside (Telnet or FTP).

  How to translate the Private IP of the server to the public ip address for the external interface of the firewall and specifying the port ftp or telnet only? is this possible?

  Thank you

  The pleasure is mine.

  Click rate if you found the post useful.

  sincerely

  Patrick

• PPTP VPN pix 501 question

  I'm relatively new to the security stuff.  I'm a guy of the voice.  I created a Pix 501 for IPSEC VPN and works very well.  Then I tried it setting up PPTP VPN.  I use Windows XP to connect.  It connects fine, but I can't ping to the inside interface on the PIX.  I can do this by using IPSEC.  Any ideas?   Here is my config:

  :

  6.3 (3) version PIX

  interface ethernet0 car

  interface ethernet1 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate the password * encrypted

  passwd * encrypted

  host name *.

  domain name *.

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol pptp 1723

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  access-list 101 permit icmp any any echo response

  access-list 80 allow ip 10.0.0.0 255.255.255.0 192.168.5.0 255.255.255.0

  access-list ip 10.0.0.0 sheep allow 255.255.255.0 192.168.5.0 255.255.255.0

  access-list ip 10.0.0.0 sheep allow 255.255.255.0 192.168.6.0 255.255.255.0

  pager lines 24

  opening of session

  emergency logging console

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside of *. *. *. * 255.255.255.0

  IP address inside 10.0.0.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool pool1 192.168.5.100 - 192.168.5.200

  IP local pool pool2 192.168.6.100 - 192.168.6.200

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0 access-list sheep

  NAT (inside) 1 10.0.0.0 255.0.0.0 0 0

  Access-group 101 in external interface

  Route outside 0.0.0.0 0.0.0.0 *. *. *. * 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  the ssh LOCAL console AAA authentication

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  Sysopt connection permit-pptp

  Sysopt connection permit-l2tp

  Crypto ipsec transform-set high - esp-3des esp-sha-hmac

  Crypto ipsec transform-set esp - esp-md5-hmac RIGHT

  Crypto dynamic-map cisco 4 strong transform-set - a

  Crypto-map dynamic dynmap 10 transform-set RIGHT

  Cisco dynamic of the partners-card 20 crypto ipsec isakmp

  partner-map interface card crypto outside

  card crypto 10 PPTP ipsec-isakmp dynamic dynmap

  ISAKMP allows outside

  ISAKMP key * address 0.0.0.0 netmask 0.0.0.0

  ISAKMP nat-traversal 20

  part of pre authentication ISAKMP policy 8

  ISAKMP strategy 8 3des encryption

  ISAKMP strategy 8 md5 hash

  8 2 ISAKMP policy group

  ISAKMP life duration strategy 8 the 86400

  vpngroup address pool1 pool test

  vpngroup default-field lab118 test

  vpngroup split tunnel 80 test

  vpngroup test 1800 idle time

  Telnet timeout 5

  SSH 10.0.0.0 255.0.0.0 inside

  SSH 192.168.5.0 255.255.255.0 inside

  SSH 192.168.6.0 255.255.255.0 inside

  SSH timeout 5

  management-access inside

  Console timeout 0

  VPDN PPTP-VPDN-group accept dialin pptp

  VPDN group PPTP-VPDN-GROUP ppp authentication chap

  VPDN group PPTP-VPDN-GROUP ppp mschap authentication

  VPDN group PPTP-VPDN-GROUP ppp encryption mppe auto

  VPDN group VPDN GROUP-PPTP client configuration address local pool2

  VPDN group VPDN GROUP-PPTP client configuration dns 8.8.8.8

  VPDN group VPDN GROUP-PPTP pptp echo 60

  VPDN group VPDN GROUP-PPTP client for local authentication

  VPDN username bmeade password *.

  VPDN allow outside

  You will have to connect to an internal system inside and out run the PIX using pptp.

  For ssh access the PIX, you will also need additional configuration, see the section on code PIX pre 7.x, section access ssh to the security apparatus .

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008069bf1b.shtml#C4

  Concerning

• Pix 501 connection problems

  I am very new to cisco equipment and I was wondering if someone could help me with this (probably very simple question).

  When connecting to my pix via the browser (https://192.168.1.1/startup.html), the browser never took the start screen with the message that says "loading, please wait." This leads me to believe that the firewall is rejecting connections from my machine (which uses dhcp to get an ip address of the pix).

  To work around this problem, I tried to connect to the CLI using hyperterminal. I can connect and run a few basic commands as 'show version', but cannot log on as a user with permissions.

  If the web interface has a default connection of void & empty, surely the cli should be the same?

  Is anyone able to tell me what is the default login, so that I can start confguring the pix via the cli?

  Thanks in advance.

  Justin Spencer.

  Please see below for info pix:

  Cisco PIX Firewall Version 6.3 (3)

  Cisco PIX Device Manager Version 3.0 (1)

  Updated Thursday, August 13 03 13:55 by Manu

  pixfirewall until 12 minutes 18 seconds

  Material: PIX - 501, 16 MB RAM, 133 MHz Am5x86 CPU

  Flash E28F640J3 @ 0 x 3000000, 8 MB

  BIOS Flash E28F640J3 @ 0xfffd8000, 128KB

  0: ethernet0: the address is 0011.937e.0486, irq 9

  1: ethernet1: the address is 0011.937e.0487, irq 10

  Features licensed:

  Failover: disabled

  VPN - A: enabled

  VPN-3DES-AES: enabled

  The maximum physical Interfaces: 2

  Maximum Interfaces: 2

  Cut - through Proxy: enabled

  Guardians: enabled

  URL filtering: enabled

  Internal guests: 10

  Throughput: unlimited

  Peer IKE: 10

  This PIX has a restricted license (R).

  Serial number: 808301473 (0x302db3a1)

  Activation key running: 0xb53be54d 0x26da18f9 0xb2b78cef 0x8fe1abb6

  Configuration changed from enable_1 to 15:36:42.554 UTC, Monday, November 8, 2004

  pixfirewall >

  long live java.

  Please this mark as resolved, others won't waste time.

  Thank you

• Microsoft secondary authority w / Cisco router / PIX 501

  I'm trying to get digital certificates to work on my 2621XM router. I have also

  need to put in place on the three firewalls PIX 501 but who have not obtained until now still. I have

  don't have no access to the CA root, but it could bring in line if I had to. I have

  have a stand-alone Microsoft subordinate CA that I want to use to publish all

  certificates.

  Is it possible, as well with the router and the firewall? If so, what version

  the IOS do I need? I installed the add-on CEP at HQ. I can't

  It works and I'm starting to wonder if it is still possible. If this doesn't

  work, how can I make it work? I have all the documents that Cisco has combed

  on the subject and have gotten nowhere.

  Any help would be greatly appreciated. Thank you.

  Jennnette,

  I sent this document, let me know how it goes or if you have any questions.

  Kurtis Durrett

• Cisco 3640 to the PIX 501 site 2 site VPN performance specifications.

  I intend on creating a site-2-site VPN in Star configuration with a Cisco 3640 as the hub and PIX 501 at the remote sites. My question is around the plug that I read.

  .

  The specifications for a PIX-501-BUN-K9 tell PIX 501 3DES Bundle (chassis, SW, 10 users, 3DES).

  .

  A question is what really "10 users. Which is the limit of the number of concurrent sessions, I have on the VPN at a given time, or that it means something else?

  .

  I also read the specs say that the Maximum number of VPN tunnels that can support a PIX 501 is 5. Because I'm not going to make a tunnel between the PIX 501 at the remote site and the 3640 on the central site, I think I would be OK. Is that correct or is the max value talk the maximum number of concurrent sessions on the tunnel tunnels?

  .

  Thank you.

  UDP traffic always creates a session in the PIX so that the return traffic will be allowed in. The UDP timeout is 2 minutes but IIRC. If you go around NAT with a statement of "nat 0" should not create an xlate I think.

  The real time is hard to say really, probably around 2 minutes for a UDP-only user, you would probably make a few 'local sho' orders on the PIX to really see for sure however.

• The import of the PIX 501 config to ASA 5505

  Is there something special that must occur to import a PIX 501 (IOS Version 6.3) config to an ASA 5505 appliance or is it as simple as download the config?

  Greg

  No, this isn't unfortunately because your pix is running 6.4 and the ASA 5505 will run a minimum of code 7.x and there were quite a few changes. Note that many existing commands would work, but some will not. Attached is a link to a doc for improving pix ASA who speaks both a manual method and an assisted version of tool -.

  http://www.Cisco.com/en/us/docs/security/ASA/migration/guide/pix2asa.html

  Jon

• PIX 501 DNS resolution with static route

  I use a pix 501.

  I have an internal DNS server behind the pix that uses my DNS of the ISP servers to resolve external domains.

  Now, I want to host a web site on the same server.

  To allow external access to the web server, I add the following:

  outside_in_http list access permit tcp any host A.B.C.D eq www

  static (inside, outside) A.B.C.D L.M.N.O netmask 255.255.255.255 0 0

  Access-group outside_in_http in interface outside

  It is very good and allows web access. The problem is that the server is able to resolve DNS queries.

  How can I allow my server to resolve DNS again securely. I guess it's pretty simple to do, but I'm having a lot of trouble to find the solution.

  Thanks in advance

  Dylan

  On your IP set dns to 67.38.230.69, then ping www.yahoo.com server from guest... what resovle?

• Newbie Pix 501 HTTP authentication timeout

  two issues here:

  1. users that connect to the Internet through the Pix 501 ask about every three minutes to enter their user name and password. There must be a setting to change this, my dealer said there is no.

  2. users that connect to the Internet, the first time have their IE session. By clicking Stop and then refresh or House brings to the top of the page. Any ideas.

  Thanks in advance for any ideas you may have

  Jeff Charland

  Jeff,

  First rule is to never trust your seller on technical issues;). Your dealer is wrong. You can indeed change the moment where a user is re - you are prompted to enter their credentials. There are basically 2 parameters, you need to know about the pix regarding delays of authentication:

  (1) the inactivity timer. It's just like that. It expires an authenticated session via the PIX to hit X amount of time without all the traffic. The default timer on the PIX for this setting is 0, which means that we are no period of inactivity by the user (by default) monitor.

  (2) the absoltue timer. Again, is to noise. This timer starts as soon as the user is authenticated and works continuously. When the time is reached, the user is obliged to to re-authenticate when they try to start a new connection (for example, by clicking a link in a web page). The default setting for the absolute timer is 5 minutes.

  We recommend that you do not keep an absolute clock set for security purposes, but for ease of access, you can change these settings. Something like that would not be a 'off the wall' setting:

  timeout uauth 01:00 absolute uauth 0: idle from 10:00

  These settings will force the user to to re-authenticate every hour (absolute) or every 10 minutes after the connection becomes inactive.

  And finally, no idea about #2 above. It happens with all users. Anyone who has tried to Netscape to see if it is a question only IE?

  Scott

• Reseting ipsec on PIX 501

  Hi all. Just a quick question. I can't seem to find how to reset ipsec on PIX 501 and force her to negotiate again and I also want to reset statistics for ipsec his. I know that I saw somewhere, orders, but now can't seem to find the commands from anywhere.

  Thanks in advance for any help.

  Hello...

  Config mode...

  ISAKMP crypto claire his

  - and -

  clear crypto ipsec his

  PS. You can find the commands on the PIX by entering the configuration mode by typing...

  PIX01 (config) # clear cry?

  Hope the above helps and please note messages!

• PIX 501 in the firewall of the Web server

  Hello

  At the suggestion of a colleague, we bought a firewall PIX 501 to protect our new Win2003 web server and a UNIX/Oracle DB server.

  I've never worked with before firewalls.

  Our servers are located in a cage at the ISP and belong to us. There are only two servers providing web site. I have read the documentation in the Getting Started book and it does not answer my question.

  We have 2 web sites with different IP numbers on our web server. Let's say 140.5.5.4 and 140.5.5.5. I understand that I have will redefine the numbers with the firewall (192,...) but I do not understand how the routers at the ISP will be able to route requests for two websites to the firewall when it has one IP number, say 140.5.5.1?

  Any help is appreciated.

  Thank you, Jerry

  Jerry,

  what you are referring is called port forwarding. Whether you a PIX with a public IP address 12.1.1.1 and your web servers are respectively and 12.1.1.2 12.1.1.3. Port forwarding is really a 2 step process:

  * a static translation of the public IP address of the PIX (12.1.1.1) at the address of the web server (12.1.1.2)...

  static (inside, outside) tcp 12.1.1.1 12.1.1.2 www www netmask 255.255.255.255 0 0

  * an intermediate statement basically "all web requests should be allowed in the pix outside of the interface"...

  driving permit tcp host 12.1.1.1 eq www everything

  Here is a link that will help you to clarify this point:

  www.Cisco.com/warp/Customer/707/28.html

  This should help you get started. Regarding the basic configuration, it takes config examples on the Cisco site, if you have access CCO.

  Let me know if it helps.

  Rob H.

• PIX 501 Switch hardware Issue

  My PIX 501 switch stopped working or has failed. The PIX is 10 months old. This is the second time I've seen that happen. The first time I sent it fixed by repair out of warranty, but they couldn't fix it. They said it was a chip owner they could not get from Cisco.

  In any case, the unit has power. I am able to connect through the console and the WAN via SSH port. It is fully operational with the exception of the portion of the switch of the device.

  Has anyone seen this kind of problem before? I've never seen a switch or a hub spoil. It's the second PIX to go wrong in the same local area network installed. PCs and servers all continue networking function wise, so connected to another switch.

  Is that what I can do about this problem?

  Thank you

  Vince

  Vince,

  It depends on what type contract you have. You can open a TAC case and they will let you know the track.

  Let me know if you have any questions.

  Please mark this topic as resolved, so that others can benefit from.

  Kind regards

• default configuration of the pix 501 past recovery/restoration

  You need to reset the PIX 501 (lost password). I tried the password recovery instructions and accesses the monitor command by using the connection of the console, but cannot get the file to be transferred using tftp (ping command also expires).

  1. in case ordering interface be set to 0 or 1 (I used 1)

  2. the order of the address I was using 192.168.1.1

  3. order the server, I was using the IP address of the tftp server

  4. entry door? (Which is the PIX or the computer)?

  5. in addition to the blue console cable that if all other cables should be connected and which ports.

  Thank you

  I'm guessing you already have this document:

  http://www.Cisco.com/en/us/customer/products/HW/vpndevc/ps2030/products_password_recovery09186a008009478b.shtml

  I would like to use the default value inside of the interface of the 1. Connect a standard ethernet cable to one of the Interior ports on the PIX and the other to your PC that has the server tftp on it of the interface software. Make sure that you see a link on both ends light. If not, take this cable or save it if you think it is a crossover cable. If you set the PIX address to: 192.168.1.1, then I would set my tftp server address: 192.168.1.2 or something in the same subnet. In this way we will not care what is the gateway address. No need to let pesky routers get in the way, when we're down!

  Since you asked the question 5 above, I'll explain. You should have a console cable connected, it seems do you since you can get to the monitor > prompt. You'll also need an ethernet cable plugged in a PC running a server tftp with the IP address: 192.168.1.2 3Com made a server tftp really good F * R * E * E.

  http://support.3Com.com/software/utilities_for_windows_32_bit.htm

  Select the last file in the list. Make sure you get that file recovery of password for the Cisco link above for the PIX OS version you are running. Configure the tftp server to point to the directory containing the PIX password recovery file and you are ready. Good luck, Derrick