Statics of PIX & ACL

Similar Questions

• PIX - ACL order

  Hello

  a year before, this is a conversation about the issue on the agenda in which the PIX - ACL are applied.

  There where some of the different opinions about it.

  Are applied on a basis first match as IOS - ACL or on an adjusted basis?

  I remember someone saying that the old 'led' - statements have been applied to the adjusted basis.

  Is this good? and what does "adjusted"?

  And what of the ACL?

  "If they are not applied" first match "it wouldn't make sense to give them an order in the MDP.

  Another question: I wonder how the PDM can add rules in the middle of the access list without disrupting traffic. In IOS - ACL without sequence numbers, I have to rewrite the entire ACL to change a line in the middle.

  ducts - adjusted

  ACL - first match

  Adjustment of the means that the PIX will scan all lines and choose the one that * best * corresponds to the traffic (source/destination/ports etc...).

  The PIX does not run IOS. You can remove a line of an ACL without removing the entire ACL.

  Scott

• Interaction of Ganymede + and radius ACS 2.6 download PIX ACLs

  We have ACS v2.6 running and control our connection to remote, routers and switches access. We are now looking to add support for a PIX firewall internal and want to use downloadable ACS ACL for the PIX. (to control outbound traffic through the PIX for authenticated users)

  We have achieved this help attributes RADIUS of Cisco IOS/PIX

  [009\001] cisco-av-pair on ACS. (and ACL restrictions of access on access to users)

  However the problem we noticed is that any user is valid in our database of CiscoSecure or SecureID can authenticate and gain access to through the firewall, even if they are not allowed to do this (and as it is by default on PIX from inside to outside is allowed unlimited full access).

  Was then imposed restrictions on network access on the CiscoSecure ACS for our PIX - to allow only access of corresponding user groups, but it did not work with RADIUS only GANYMEDE + (I guess that's because the RADIUS does not support approval).

  We must work with GANYMEDE + and the passes of the ACS to the bottom of the ACL number/ID for the PIX for users allowed.

  Question: We want to use downloadable s ACL of ACS for the PIX (for reasons of central support) is possible using GANYMEDE + and if yes how we re CiscoSecure ACS suitable for the ACL example below;

  pix_int list access permit tcp any host 10.x.x.x eq 1022

  pix_int list access permit tcp any host 10.x.x.x eq 1023

  Thank you

  Download ACL works only with the RADIUS, as described here:

  http://www.Cisco.com/warp/public/110/atp52.html#new_per_user

  You can continue to set the ACL on the PIX itself and simply pass the ACL via GANYMEDE number (as shown here: http://www.cisco.com/warp/public/110/atp52.html#access_list), but you can actually spend the entire ACL down via GANYMEDE, sorry.

• Static translation PIX

  Just a quick question I have if I'd put on the table. I have a Pix 515, with a total of four DMZ. I had to configure static mappings in the DMZ for some servers. Here's my question. There are three types of static translations:

  High and low note see security levels.

  1. static (high, low) high low

  2. static (high, low) high high

  3. ????

  What is the third static confgiuration and that it would be used for.

  Thanks in advance

  Like this?

  http://www.Cisco.com/univercd/CC/TD/doc/product/iaabu/PIX/pix_sw/v_63/cmdref/s.htm#1026694

  Happy, we could help.

  Scott

• PIX ACL user downloadable issues

  Recently, I opened a TAC case on an issue that I had with user downloadable ACLs on a radius server. I use the user acl on an intranet pix firewall that protects some servers. We have programmers who need special access for them and tried to have the ACL of assigned dynamically. It turns out that TAC said even if I had the correct ACL and they were applied to the user, I must have the same ACL allowing traffic on the interface which runs incoming traffic. There is no sense to me due to the fact that my goal was to get rid of permanent acl and not have to worry about the use of IP source addresses. I could have just the connection of the user through http and it gets the acl. Then finally the active uauth timer and removes the ACL so do not leave a hole on the PIX. I totally miss the downloadable ACLs goal, so if someone could shed some light on the subject I would appreciate it :) I have that someone has a solution or another solution to the problem that I have please do not hesitate to post! Thanks advance!

  Tony

  For authentication and ACL downloadable works, you need two ACLs on the PIX, the ACL interface and authentication ACL. You can consider the ACL interface as a trigger for the ACL authentication should it allow traffic through to trigger authentication. It must also allow the same traffic that the auth acl which means it is sometimes easier to make more restrictive the more permissive acl interface and the auth acl.

  for example if you have users on 192.168.1.0 24 inside interface and you want to authenticate you to access Terminal Server services, you can if you want to configure the inside access list to allow all traffic to 192.168.1.0/24

  ! inside the 192.168.1.0 auth trigger

  permit 192.168.1.0 ip access list inside_access_in 255.255.255.0 any

  but deny all in the acl of authentication, which means that all traffic required authentication/authorization first.

  ! authentication for 192.168.1.0

  ! don't authenticate DNS and ICMP

  inside_authentication list access deny udp 192.168.1.0 255.255.255.0 any eq 53

  inside_authentication list access deny icmp 192.168.1.0 255.255.255.0 any

  ! authenticate everything.

  permit 192.168.1.0 ip access list inside_authentication 255.255.255.0

  ! apply access lists

  inside_access_in access to the interface inside group

  AAA game inside_authentication inside RADIUS authentication

  Your ACL ACS/RADIUS would be configured to

  ! term serv

  permit tcp 192.168.1.0 255.255.255.0 any eq 3389

  ! http

  permit tcp 192.168.1.0 255.255.255.0 any eq 80

  That would provide the term serv and http access to an authenticated user. Your logs show permission denied for all other access to this user after authentication.

  I hope this helps.

• static routes - PIX outside address

  I tried to get a configuration (PIX501) which allows inside customers access to the outside and also allowing outside access to a smtp mail server in-house. From what I tried, it seems that I can't use the external IP address of the pix for the static control (indoor, outdoor). If I do other client access to the outside world is denied.

  So far I couldn't find any documentation about it. Can someone point me in the right direction plse?

  Hi morris,.

  I Don t know what the other guys are talkin´about, but it seems to me that they do not exactly understand your question and provide you with wrong information.

  In my opinion you want to translate all your inside source of addresses to the address of interface outside. It is already well configured, I saw in your config file. Indeed, these two commands are correct:

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  What bothers you is you want your mail server to be accessible from the outside to the inside for SMTP. The command you tried is:

  public static interface (inside, outside) MyServer netmask 255.255.255.255

  And it does not work.

  The command you need is the following:

  public static 25 25 MyServer netmask 255.255.255.255 interface tcp (indoor, outdoor)

  This static creates the translation for tcp port 25 (smtp) outside address to port 25 of your inside the server interface.

  I advice lets you modify the line "access-list permits outside_access_in tcp any any eq smtp" in "outside_access_in of the list of permitted access tcp any host 209.164.3.5 eq smtp".

  Put all together, modifications, you must perform:

  not static (inside, outside) interface MyServer netmask 255.255.255.255

  public static 25 25 MyServer netmask 255.255.255.255 interface tcp (indoor, outdoor)

  no access list outside_access_in not allowed tcp any any eq smtp

  outside_access_in list access permit tcp any host 209.164.3.5 eq smtp

  Finally make a clear xlate and it will work.

  Best regards and good luck,

  Leo

• Cisco ASA Cisco 831 routing static. help with ACL, maybe?

  Hi all

  What should be a simple task turns out to be difficult and I really need help.

  The Cisco ASA obviously isn't a strong point on mine and could do with a point in the right direction. I hope that this will allow me to learn more about the ASA 5505.

  OK so I have an ASA 5505. VLAN 1 is 192.168.254.1 and VLAN 2 DHCP of my cable modem.

  I have a cisco 831 Ethernet router that will sit between my main LAN and my LAN test I want to implement for multicasting. the Cisco 831 has 1 Ethernet as 192.168.254.254 and Ethernet 0 is 10.1.1.1.

  The ASA I have an interior route 10.0.0.0 255.0.0.0 192.168.254.254.

  On the Cisco 831, there is a route 0.0.0.0 0.0.0.0 192.168.254.1. I can pass traffic via Cisco 831 to the ASA 5505 and internet, for example I can ping 8.8.8.8 and access everything on my main local network, but the other wan of any host inside the ASA 5505 is unable to ping anything on 10.1.1.x.

  Where I'm going wrong? I did all my access to my a whole ASA, but it is still unable to do anything.

  I will attached my configs with deleted passwords here and would like a good kick in the right direction. Without a doubt, it's something simple I'm missing and I'm sure it's with the ACL on the ASA 5505 like the packet tracer said that the package is abandoned due to the ACL

  Thank you. :)

  Thus, all traffic between these two LANs will travel on ASA, on the same interface.
  Then please add this command in the global configuration of the ASA:
  permit same-security-traffic intra-interface

• PIX and ASA static, dynamic and RA VPN does not

  Hello

  I am facing a very interesting problem between a PIX 515 and an ASA 5510.

  The PIX is in HQ and has several dynamic VPN connections (around 130) and IPsec vpn remote works very well. I had to add a PIX to ASA L2L VPN static and it does not work as it is supposed to be. The ASA 5510, at the remote end, connects and rest for a small period of time, however, all other VPN connections stop working.

  The most interesting thing is that ASA is associated with the dynamic map and not the static map that I created (check by sh crypto ipsec his counterpart x.x.x.x). However, if I make any changes in the ACL 'ACL-Remote' it affects the tunnel between the PIX and ASA.

  Someone saw something like that?

  Here is more detailed information:

  HQ - IOS 8.0 (3) - PIX 515

  ASA 5510 - IOS 7.2 (3) - remote provider

  Several Huawei and Cisco routers dynamically connected via ADSL

  Several users remote access IPsec

  A VPN site-to site static between PIX and ASA - does not.

  Here is the config on the PIX:

  Crypto ipsec transform-set ESP-3DES-ESP-SHA-HMAC-IPSec esp-3des esp-sha-hmac

  Dyn - VPN game 100 Dynamics-card crypto transform-set ESP-3DES-ESP-SHA-HMAC-IPSec

  Crypto dynamic-map Dyn - VPN 100 the value reverse-road

  VPN - card 30 crypto card matches the ACL address / remote

  card crypto VPN-card 30 peers set 20 x. XX. XX. XX

  card crypto VPN-card 30 the transform-set ESP-3DES-ESP-SHA-HMAC-IPSec value

  VPN crypto card - 100 - isakmp dynamic Dyn - VPN ipsec

  interface card crypto VPN-card outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 65535

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  access list ACL-remote ext ip 10.0.0.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

  Thank you.

  Marcelo Pinheiro

  The problem is that the ASA has a crypto acl defined between host and network, while the remote end has to the network.

  Make sure that the acl is reversed.

• PIX and ACS ACL downloadable Question

  Good day to all,

  I'm just working on a project to test using a PIX 535 and a cisco ACS (we use RADIUS) and I need to know what order the pix acl is applied.

  On the pix, we have a set of rules (https, ssh), then the user get authenticated and they get more rules (https, ssh, pop3, imap, im). It works well, but now we have a problem, can you use rules ACSACL to remove the default rights within the rules on the pix?

  Basically I'm curious to know what order the parsed pix ACLs, (ACSACL and then pix ACL, pix ACL the ACSACL, or none of the above)

  all the links on more information would be great.

  Thanks for any information,

  Brian

  I did some tests with ACL applied by a Radius Server on a PIX 525 6.3.3 running.

  In my particular case, the user is a remote VPN connection. I ACL applied on the external interface, and then on the shelf, I applied the specific user against another ACL.

  The ACL on the external interface is applied first. The downloadable ACLs cannot add services that are not listed in the other ACL, however, it can refuse and remove services.

  You use your ACL in a different way that I like it. I use a server Radius of third parties and the use of the ACL extended via the Id attribute of the filter.

  See you soon,.

  -Joshua

• PIX 520

  Can I allow outside users to connect to an IP address on the inside with the help of NAT I need to establish a connection with a DCOM application and apparently it does ' t work with NAT.

  Thank you

  To establish a connection between the external and internal interface interface, you need a static and an ACL. The static method CAN map the IP address of the host to himself, effectively bypassing NAT, but this means that the internal host must have valid Internet a routable IP address.

  For example, assume that your internal host has a 209.1.2.3 Internet address, your config might look like:

  > static (inside, outside) 209.1.2.3 209.1.2.3 netmask 255.255.255.255 0 0

  > list of allowed inbound ip access any host 209.1.2.3

  > interface incoming group-access outside

  Of course, you should make sure that 209.1.2.3 is routed to your PIX.

• Treatment of ACL interface...

  For this question, let me first series, the scenario...

  Applied to the external interface - ACL_out SMTP allows all IP addresses.

  ACL_dmz applied to the dmz interface - SMTP allows only some certain machines in the DMZ (implicit deny statement at the end of list).

  The STATIC controls have been set up for all machines in the DMZ.

  A package of SMTP from the outside would be able to go to any machine in the DMZ (do not take into account if the host is listening on port 25), or only those specified by the STATIC commands?

  Basically, my question is whether once a package passes an ACL on an interface (for example, apart from the interface), is the package again treated to the next interface (for example, the perimeter network or inside interface), or what is once the package passes one of the interfaces, it is sent to its destination regardless of ACL applied on interfaces on which the package runs?

  Thank you.

  If the package passes through the external interface in the demilitarized zone, the ACL applied to the DMZ interface has no effect.

  When a package arrives first in the int outdoors, the ACL applied to the external interface is checked (using the static method) and if the packet is permitted, the PIX creates a connection for her entry. Return on this connection (inheriting from the DMZ interface) packets are allowed to proceed without any thorough ACL check.

  It's exactly the same thing to say, a package inside out to the Internet, you do not have to apply an ACL to the external interface allowing these back, cause a connection was created.

  If you want to restrict what hosts/ports DMZ people on the outside can reach, can do you this with you (dmz, outside) static and your ACL applied to the external interface. The ACL applied on the DMZ interface is really only for connections on the DMZ interface, which probably isn't going to be something else.

• VPN to PIX, Win2K, Active Directory - where to start?

  Hello world.

  I am waiting the arrival of a PIX 515 and 501 for firewalls and creating VPN between my main site and a remote location. Remoteness is having a LAN installed but will not have a real Win2k domian while the main site is an area complete with exchange and AD win2k. The two site will connect to INet w / cable modems.

  Here's the question:

  Is it possible to have this remote site to be part of my site main area via the VPN? Can I set up a server on the remote site to replicate AD to, in which case the VPN is stopped for some reason any. Do I need to open ports on the firewall or not because it will be on a VPN?

  Is it an easy thing to do? Is a beginner at the top of his head?

  Thanks in advance for any advice.

  Marc

  No router required - basically, everything will be static routed - your customers, regardless of the site, will have the pix as the default gateway. each pix will have a default gateway configured, by you, by a statement of 'road '. Each pix ACL crypto will also act as a static route through the tunnel to the other pix

• ACL IP and TCP ACL... What is the difference?

  Hello

  I have a few questions on the ACL.

  1. for PIX ACL, let's say I want to host a Web server in the network internally (just to simplify my question), and I do not PAT, but only a static NAT

  public static 202.188.100.1 (Interior, exterior) 10.1.1.1 netmask 255.255.255.0

  acl_out tcp allowed access list all 10.1.1.1 eq 80

  Access-group acl_out in interface outside

  Done the above equivalent to

  public static 202.188.100.1 (Interior, exterior) 10.1.1.1 netmask 255.255.255.0

  ip access list acl_out permit any 10.1.1.1

  Access-group acl_out in interface outside

  2. for IOS ACL, is it possible to block A (10.1.1.0/24) network access to network B (10.1.2.0/24) but to allow access from network B to network A? How can I do?

  Thank you.

  Hello

  1. first of all your ACL is a little bad, you need to enable connections to the public of your devices address and not the private sector when allowing traffic from the outside.

  The answer to your first question is no, if you don't mind the tcp 80 port in your access list then you allow just that, if you allow ip in your access list then you allow all IP protocols based including all TCP ports, UDP and ICMP ports all.

  2. you can do this using either the keyword in your access list or reflexive access lists.

  Network B to an ACL

  ---

  IP 10.1.2.0 allow 0.0.0.255 10.1.1.0 0.0.0.255

  Network from A to B ACL

  ---

  ip licensing 10.1.1.0 0.0.0.255 10.1.2.0 all created 0.0.0.255

  Means that any traffic can pass from network B to network A, however only established connections (packets with the ACK bit value) are admitted from B to A.

  The other method is reflexive-list using access which are with State of access lists. When the traffic moves from one network to the other a dynamic access list is created, traffic is only allowed to enter the network source if a dynamic entry is present in the table with the same source and destination IP information. An access list works in a direct, so from A to B, if you wanted to allow B to talk to A you need to configure specific static access list entries.

  HTH

  PJD

• Downloadable ACLs for users of VPN

  Hello

  I replaced the old pix with ASA (7.2). There were groups configured for the remote VPN users authenticated through the ACS and ACS download a specific ACL for each group to the PIX. After the replacement, users cannot establish the VPN connection. After troubleshooting, I discovered that the downloadable ACLs were not working very well. When I disabled this option the established tunnel. When I get back to the old pix with the same configuration, it works very well with downloadable ACL option. I opened a TAC case and he said the v3.0 ACS (I) are not compatible with the ASA. He did not really convince me and he asked to try to use the option to pair AV. I tried option pair AV with ASA and it did not work also. can you please advice.

  Hello

  Check out this point,

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCef21184

  In addition, 3.0 is very old, and I guess that in this version, we have "Downloadable PIX ACL" and not "downloadable IP ACL", on ASA download able ACL will work but with "Downloadable IP ACL" but not with "Downloadable PIX ACL".

  Kind regards

  Prem

• Subject of LCA in PIX?

  I use version 7.x PIX IOS.

  I have a very basic question about the ACL. As cisco router IOS in each access list it is an implicit deny a whole at the end of the default ACL. Is the same rule apply to the PIX ACL or we write explicitly refuse at the end of the instructions of the ACL?

  Hello

  By default, all access lists have an implicit refusal unless you specify explicitly allowed.

  I hope this helps.

  Glen