The import of the PIX 501 config to ASA 5505

Similar Questions

• Cisco 3640 to the PIX 501 site 2 site VPN performance specifications.

  I intend on creating a site-2-site VPN in Star configuration with a Cisco 3640 as the hub and PIX 501 at the remote sites. My question is around the plug that I read.

  .

  The specifications for a PIX-501-BUN-K9 tell PIX 501 3DES Bundle (chassis, SW, 10 users, 3DES).

  .

  A question is what really "10 users. Which is the limit of the number of concurrent sessions, I have on the VPN at a given time, or that it means something else?

  .

  I also read the specs say that the Maximum number of VPN tunnels that can support a PIX 501 is 5. Because I'm not going to make a tunnel between the PIX 501 at the remote site and the 3640 on the central site, I think I would be OK. Is that correct or is the max value talk the maximum number of concurrent sessions on the tunnel tunnels?

  .

  Thank you.

  UDP traffic always creates a session in the PIX so that the return traffic will be allowed in. The UDP timeout is 2 minutes but IIRC. If you go around NAT with a statement of "nat 0" should not create an xlate I think.

  The real time is hard to say really, probably around 2 minutes for a UDP-only user, you would probably make a few 'local sho' orders on the PIX to really see for sure however.

• default configuration of the pix 501 past recovery/restoration

  You need to reset the PIX 501 (lost password). I tried the password recovery instructions and accesses the monitor command by using the connection of the console, but cannot get the file to be transferred using tftp (ping command also expires).

  1. in case ordering interface be set to 0 or 1 (I used 1)

  2. the order of the address I was using 192.168.1.1

  3. order the server, I was using the IP address of the tftp server

  4. entry door? (Which is the PIX or the computer)?

  5. in addition to the blue console cable that if all other cables should be connected and which ports.

  Thank you

  I'm guessing you already have this document:

  http://www.Cisco.com/en/us/customer/products/HW/vpndevc/ps2030/products_password_recovery09186a008009478b.shtml

  I would like to use the default value inside of the interface of the 1. Connect a standard ethernet cable to one of the Interior ports on the PIX and the other to your PC that has the server tftp on it of the interface software. Make sure that you see a link on both ends light. If not, take this cable or save it if you think it is a crossover cable. If you set the PIX address to: 192.168.1.1, then I would set my tftp server address: 192.168.1.2 or something in the same subnet. In this way we will not care what is the gateway address. No need to let pesky routers get in the way, when we're down!

  Since you asked the question 5 above, I'll explain. You should have a console cable connected, it seems do you since you can get to the monitor > prompt. You'll also need an ethernet cable plugged in a PC running a server tftp with the IP address: 192.168.1.2 3Com made a server tftp really good F * R * E * E.

  http://support.3Com.com/software/utilities_for_windows_32_bit.htm

  Select the last file in the list. Make sure you get that file recovery of password for the Cisco link above for the PIX OS version you are running. Configure the tftp server to point to the directory containing the PIX password recovery file and you are ready. Good luck, Derrick

• Help the PIX 501 - cannot access startup.html

  I'm new to the network and has received a job to configure the PIX 501 firewall.

  The fact is:

  We use IP table rules as a firewall on a linux machine. My pc is connected to a switch. So I use the yellow network cable to connect the port of the Pix 501 0 to the port in the switch. Then I disconnect my pc of swich cable and plug into the port of the Pix 501 1.

  My pc is to use a static ip address before. I try to change to automatically get an IP address, but it will not work. So I changed the setting and use the IP address originally. Pop up message network connection icon says that the local connection is enabled. But when I try to ping 192.168.1.1, request time-out. Also I can't acess the https://192.168.1.1/startup.html.

  I have a look at Books Online cisco and shootings of disorder, but most of them talk about the configuration or more advance features. I'm still on the very basic level to try to connect to the firewall.

  I hope someone can help me. All ideas and questions are welcome. Thank you.

  Your IP address should be fine. You do not want to have the PIX connected to your local network, even if you have the Linux firewall as well as this will cause a conflict. Keep the PIX the LAN for now. Your DNS configuration will have no effect because the url you are trying to reach is based on the IP address and not the domain name if your PC has nothing to look for.

  You have to check the cable that you use - if your PIX has only an 'inside' interface, then you must use a crossover cable. If he has four so it's built in switch for a straight cable will be fine. Is what PIX model?

  After checking the cable - see if you can console in the firewall - use the blue cable that came with the PIX and set up a connection (hyper terminal) terminal with the help of 9600, 8, no 1. If you can console and then you can stick in a basic configuration you can get.

• Configure the PIX 501 for IDS

  I have a PIX 501 with wired high-speed LAN headquarters inside and outside. Which would be a solid policy IDS to enable and what interfaces it must be applied to? There will be other measures necessary to enable IDS?

  IDS on the PIX itself is very limited, it checks only 59 signatures listed here (http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/gl.htm#xtocid9 under the section of signatures supported IDS). The signatures themselves are pretty basic.

  If you do not want to activate this, then for the signatures of attacks I would fix for drop/alarm/reset action, which is the default anyway.

  You will also need to set the logging to a syslog server and monitoring for any 4000nn messages in syslog, cause it event IDS.

• PIX 501 config probs - beginner needs help!

  Have a bit of a nightmare trying to set up external access to one of our servers through the pix. He is currently in its factory config.

  I tried assiginig an Acl to allow the remote desktop on port 4999 from outside, but it doesn't seem to work. I have attached the config in its current form - please help this is driving me crazy!

  1.) basically the NAT public IP address to a private IP address is on the right of ADSL router. Check that!

  ADSL Public IP TCP 4999 to PIX outside TCP 4999

  (2.) the config on the PIX should be good, as I posted it.

  Redirect port of PIX outside IP TCP 4999 inside private IP TCP 4999

  3.) make sure that your server meets the port TCP 4999 really!

  On windows or Unix =

  netstat - year

  You should see something like this:

  TCP 10.0.0.3:4999 0.0.0.0:0 LISTENING

  4.) another way of troubleshhot might be using "capture" on the PIX. This like tcpdump UNIX a sniffer that can show packets on an interface. I do not remember what version, this command was introduced, but you will need at least an OS PIX 6.3.x to have.

  Example:

  access-list 120 permit tcp any any eq 4999

  capture of 4999 interface 120 outdoor access list

  See Access Snapshot 4999 list 120 retail

  To use remove:

  no interface access-list 120 captures 4999 out

  No capture 4999

  Change inside interface:

  capture of 4999 interface 120 of inside access list

  See Access Snapshot 4999 list 120 retail

  sincerely

  Patrick

• Block the specific IP traffic in ASA 5505

  Hi, we have an ASA 5505 in transparent mode and run a web service online. However, we notice a number of attempts to intrution from China and Korea and we need to block these IP traffic can anyone help please?

  config script is

  transparent firewall

  hostname xxyyASA

  Select msi14F/SlH4ZLjHH of encrypted password

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  !

  interface Ethernet0/0

  Description - the Internet-

  switchport access vlan 2

  !

  interface Ethernet0/1

  Description - connected to the LAN-

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  Shutdown

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  interface Vlan1

  nameif inside

  Bridge-Group 1

  security-level 100

  !

  interface Vlan2

  nameif outside

  Bridge-Group 1

  security-level 0

  !

  interface BVI1

  Description - for management only-

  IP address xxx.yyy.zzz.uuu 255.255.xxx.yyy

  !

  passive FTP mode

  network of the WWW-SERVER-OBJ object

  Home xxx.yyy.zzz.jjj

  Description - webserver-

  WWW-SERVER-SERVICES-TCP-OBJ tcp service object-group

  Description - Services published on the WEB server-

  WWW-SERVER-SERVICES-UDP-OBJ udp service object-group

  Description - Services published on the WEB server - UDP

  Beach of port-object 221 225

  1719-1740 object-port Beach

  OUTSIDE-IN-ACL scope tcp access list deny any any eq 3306

  OUTSIDE-IN-ACL scope tcp access list deny any any eq telnet

  OUTSIDE-IN-ACL scopes allowed icmp an entire access list

  OUTSIDE-IN-ACL scopes permitted tcp access list any object WWW-SERVER-OBJ object-group WWW-SERVER-SERVICES-TCP-OBJ

  access list OUTSIDE-IN-ACL scopes permit tcp host xxx.yyy.zzz.uuu object WWW-SERVER-OBJ eq 3306

  OUTSIDE-IN-ACL scopes permitted udp access list any object WWW-SERVER-OBJ object-group WWW-SERVER-SERVICES-UDP-OBJ

  We need to block access of host say 64.15.152.208

  Just need the best step to follow and block access, without affecting the service or other host

  Thank you

  Insert a line like:

  OUTSIDE-IN-ACL scope access list deny host ip 64.15.152.208 all

  in front of your 3rd line "... to enable icmp a whole."

  If you have many of them, maybe do:

  object-group network blacklist

  host of the object-Network 64.15.152.208

  network-host another.bad.ip.here object

  object-network entire.dubious.subnet.here 255.255.255.0

  ...

  OUTSIDE-IN-ACL scope object-group BLACKLIST ip deny access list all

  If you want to take in scores of reputation on the outside, or the blacklist changes a lot, you might look into the Cisco ASA IPS module.

  Note that fleeing bad hosts help with targeted attacks, but not with denial of service; only, he moves to point decline since the application for the firewall server, without much effect on the net on your uplink bandwidth consumption.

  -Jim Leinweber, WI State Lab of hygiene

• Install two the separate IPSec VPNS on ASA 5505

  Hello

  I'll have set up a second tunnel IPSec VPN on my Cisco ASA 5505 to another office.  I was able to configure one without problem through the ASDM, but were not able to get the second.

  The IPSec tunnel connects to a WRVS4400N router to the other office.  I tried the debug crypto isakmp and ipsec crypto, but I get nothing.  Here is the config.  Something seems wrong on my end?   I've also attached a screenshot of the configuration settings on the remote router.

  Output of the command: "show run".

  : Saved
  :
  ASA Version 8.2 (5)
  !
  hostname WayneASA

  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP 70.91.18.205 255.255.255.252
  !
  interface Vlan5
  Shutdown
  No nameif
  security-level 50
  IP 192.168.10.1 255.255.255.0
  !
  passive FTP mode
  clock timezone IS - 5
  clock to summer time EDT recurring
  DNS lookup field inside
  DNS domain-lookup outside
  DNS server-group DefaultDNS
  75.75.75.75 server name
  75.75.76.76 server name
  domain 3gtms.com
  object-group Protocol TCPUDP
  object-protocol udp
  object-tcp protocol
  inside_access_in of access allowed any ip an extended list
  IPSec_Access to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.2.0 255.255.255.0
  inside_nat0 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.224
  inside_nat0 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.2.0 255.255.255.0
  inside_nat0 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0
  TunnelSplit1 list standard access allowed 192.168.10.0 255.255.255.224
  TunnelSplit1 list standard access allowed 192.168.1.0 255.255.255.0
  outside_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.2.0 255.255.255.0
  outside_2_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0
  outside_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0
  RemoteTunnel_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
  RemoteTunnel_splitTunnelAcl_1 list standard access allowed 192.168.1.0 255.255.255.0

  pager lines 24
  Enable logging
  Within 1500 MTU
  Outside 1500 MTU
  IP mask 255.255.255.224 local pool VPNPool 192.168.10.1 - 192.168.10.30
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access inside_nat0
  NAT (inside) 1 0.0.0.0 0.0.0.0

  inside_access_in access to the interface inside group
  Access-group out_access_in in interface outside
  Route outside 0.0.0.0 0.0.0.0 70.91.18.206 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  the ssh LOCAL console AAA authentication
  Enable http server
  http 0.0.0.0 0.0.0.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  Crypto ipsec transform-set esp-3des esp-md5-hmac VPNTransformSet
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto IPSec_map 1 corresponds to the address IPSec_Access
  card crypto IPSec_map 1 set peer 50.199.234.229
  card crypto IPSec_map 1 the transform-set VPNTransformSet value
  card crypto IPSec_map 2 corresponds to the address outside_2_cryptomap
  card crypto IPSec_map 2 set pfs Group1
  card crypto IPSec_map 2 set peer 98.101.139.210
  card crypto IPSec_map 2 the transform-set VPNTransformSet value
  card crypto IPSec_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  IPSec_map interface card crypto outside
  card crypto outside_map 1 match address outside_1_cryptomap
  peer set card crypto outside_map 1 50.199.234.229

  crypto ISAKMP allow outside
  crypto ISAKMP policy 1
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 43200
  Telnet 192.168.1.0 255.255.255.0 inside
  Telnet timeout 5
  SSH 0.0.0.0 0.0.0.0 inside
  SSH timeout 60
  Console timeout 0
  management-access inside
  dhcpd outside auto_config
  !
  dhcpd address 192.168.1.100 - 192.168.1.199 inside
  dhcpd dns 75.75.75.75 75.75.76.76 interface inside
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  internal RemoteTunnel group strategy
  attributes of Group Policy RemoteTunnel
  value of server DNS 75.75.75.75 75.75.76.76
  Protocol-tunnel-VPN IPSec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list RemoteTunnel_splitTunnelAcl_1
  3gtms.com value by default-field
  eric 0vcSd5J/TLsFy7nU password user name encrypted privilege 15
  username password encrypted URsSXKLozQMSeCBk privilege 5 lestofts
  username lestofts attributes
  type of remote access service
  algobel lBWy5eNbHMCDPzuL encrypted password username
  username algobel attributes
  type of remote access service
  type tunnel-group RemoteTunnel remote access
  attributes global-tunnel-group RemoteTunnel
  address pool VPNPool
  Group Policy - by default-RemoteTunnel
  IPSec-attributes tunnel-group RemoteTunnel
  pre-shared key *.
  tunnel-group 50.199.234.229 type ipsec-l2l
  IPSec-attributes tunnel-group 50.199.234.229
  pre-shared key *.
  tunnel-group 98.101.139.210 type ipsec-l2l
  IPSec-attributes tunnel-group 98.101.139.210
  pre-shared key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the icmp
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the dns
  inspect the pptp
  inspect the sip
  !
  global service-policy global_policy
  context of prompt hostname
  anonymous reporting remote call
  Cryptochecksum:a86adc4b23977672679b6fb72d0bc187
  : end

  You are also missing the NAT0 rule

  inside_nat0 to access extended list ip 192.168.2.0 allow 255.255.255.0 192.168.5.0 255.255.255.0

  -Jouni

• Publish the pix 501 Web server

  Remote office is connected to Headquarters via the site to site vpn. I have 1 static IP address (on the remote site) that I use for the site to site. I need to publish a web server at the remote site.

  My question is if I can use the same IP address for VPN and web server edition, I have a problem for the web server to publish

  See attachment

  Thanks for your time

  Hello

  Of course, you can use the same public IP address of your external interface for port forwarding, you just need to apply the acl to your external interface

  Add the line below to the config file. NT and try www

  Access-group interface incoming outside

  If no joy you can try to modify the acl to reflect outside keyword instead of the public IP address

  example:

  list of allowed inbound tcp access any interface outside eq www

  and delete the old (no list of access allowed tcp not incoming of any host 74.94.2yy.xxx eq www)

  Concerning

• Changing the server IP in an ASA 5505?

  Hi everyone, I know don't know anything about cisco devices. I just wanted to go on the spot. I recently did a job that has a configuration 5505 as the network gateway and a vpn for employees to work from home via the Cisco VPN remote client program. We had a main server which is the domain controller, dns, and dhcp. It was an old box 03, and I install a new 08 r2 on a different IP address box and all of the above functions migrated to it. Old server was a xxx.xxx.xxx.31, the new server xxx.xxx.xxx.6. I found the java (6.1) ASDM program and connected to the ASA, and I change.31 a.6 in as many places as I can find, however, vpn clients on the outside can connect is more to their workstations, because when I open a prompt on his computer, only IP they can ping is xxx.xxx.xxx.31, ping xxx.xxx.xxx.6, or any other address fails. I guess maybe it's in the firewall of the asa, but don't have really not ideal. At it no matter what else was I supposed to do? Somewhere I forgot? I did save for flash and reload the current, but not a physical power Reset Since I made the changes.

  Thank you.

  This new server (. 6), has he any windows firewall that might block incoming access? Well pls want to check on the server itself.

  If you can always test the old server (. 31), then the configuration on the SAA does not really much matter it has been configured to allow the subnet (192.168.0.0/24).

• PIX 501 and THE, 3DES, AES

  For a version newly produced PIX 501,

  (1) are DES, 3DES and AES activation keys all pre-installed?

  (2) how I can find on which of them is pre-installed on my PIX 501?

  (3) when I create a server VPN (on the PIX 501), I see that all three OF THEM, 3DES and AES are available in the drop-down list of the PDM configuration screen. Does that mean my PIX 501 have all three of them (FROM THE, 3DES and AES)? -If the answer is no, assume that only is preinstalled on PIX 501, then why/how can appear in the drop-down list the 3DES and AES?

  Thank you for helping.

  Scott

  Should be integrated already. depends on the way the news is your PIX 501.

  To be sure to log in to the console and type:

  See the version

  See the example output version:

  See the pixfirewall version (config) #.

  Cisco PIX Firewall Version 6.2 (3)

  Cisco PIX Device Manager Version 2.0 (1)

  Updated Thursday April 17 02 21:18 by Manu

  pixdoc515 up to 9 days 3 hours

  Material: PIX - 515, 64 MB RAM, Pentium 200 MHz processor

  I28F640J5 @ 0 x 300 Flash, 16 MB

  BIOS Flash AT29C257 @ 0xfffd8000, 32 KB

  0: ethernet0: the address is 0050.54ff.3772, irq 10

  1: ethernet1: the address is 0050.54ff.3773, irq 7

  2: ethernet2: the address is 00d0.b792.409d, irq 11

  Features licensed:

  Failover: enabled

  VPN - A: enabled

  VPN-3DES: enabled

  Maximum Interfaces: 6

  Cut - through Proxy: enabled

  Guardians: enabled

  URL filtering: enabled

  Internal hosts: unlimited

  Throughput: unlimited

  Peer IKE: unlimited

  Serial number: 480221353 (0x1c9f98a9)

  Activation key running: 0x36df4255 0x246dc5fc 0x39d2ec4d 0x09f6288f

  Modified configuration of enable_15 to 12:15:28.311 UTC Wednesday, may 1, 2002

  pixfirewall (config) #.

  Here, you should see if THE or 3DES, AES encryption is active or not. If you have just SOME so you can use the following link and get for free a new activation key that allows 3DES and AES.

  https://Tools.Cisco.com/swift/licensing/JSP/formGenerator/Pix3DesMsgDisplay.jsp

  sincerely

  Patrick

• QoS is supported on the Cisco PIX 501 or 506th?

  Hello

  There is no mention of QoS in technical for the PIX 501 and 506 records but nothing for the 515. PIX OS 7.x configuration guides do not mention specific material support.

  Does anyone know if QoS is taken care of in the 501 or 506th - I need support lines expectations for VoIP over IPSec.

  Thank you

  Chris

  QoS is supported in 7.x code, you would have to level 501/506 to 7.x code, but this is not supported on these two models, the next logical solution would be to upgrade your PIX 501/506 to asa5505s.

  Rgds

  Jorge

• PIX 501 to allow access to the ftp server

  Hello

  We have a public ip address of the pix 501 and the other, I want to access the ftp server on the internal network from the outside. I tried to configure the PDM by a static nat, which translate to the address of the FTP to the public address, but then none of the stations networks could out - how can I configure it?

  I would also like to know what ports should I open on the acl for access to the ftp server.

  Thank you, daguech

  Yes, sorry... You must use the unique host for addresses command. The access list is applied to your external interface?

  for example, the command would be:

  Access-group acl_out in interface outside

  Also, can you connect to the local ftp server behind a firewall?

• Connectivity random Cisco Pix 501

  Hello. I'm having some trouble with my CISCO PIX 501 Setup.

  A few months I started having random disconnects on my network (from inside to outside). The machines can ping the DC or the Pix, but impossible to surf the internet. The only way to make them go outside is a reboot of Pix.

  My configuration is:

  -----------

  See the ACE - pix config (config) #.
  : Saved
  : Written by enable_15 at 09:23:07.033 UTC Tuesday, June 3, 2014
  6.3 (3) version PIX
  interface ethernet0 car
  interface ethernet1 100full
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100
  activate 8Ry34retyt7RR564 encrypted password
  2fvbbfgdI.2KUOU encrypted passwd
  hostname as pix
  domain as.local
  fixup protocol dns-length maximum 512
  fixup protocol esp-ike
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol pptp 1723
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  fixup protocol tftp 69
  names of
  access-list acl_out permit icmp any one
  ip access list acl_out permit a whole
  access-list acl_out permit tcp any one
  Allow Access-list outside_access_in esp a whole
  outside_access_in list access permit udp any eq isakmp everything
  outside_access_in list of access permit udp any eq 1701 all
  outside_access_in list of access permit udp any eq 4500 all
  outside_access_in ip access list allow a whole
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  outside 10.10.10.2 IP address 255.255.255.0
  IP address inside 192.168.100.1 255.255.255.0
  alarm action IP verification of information
  alarm action attack IP audit
  history of PDM activate
  ARP timeout 14400
  Global 1 10.10.10.8 - 10.10.10.254 (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0
  Access-group outside_access_in in interface outside
  access to the interface inside group acl_out
  Route outside 0.0.0.0 0.0.0.0 10.10.10.1 0
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  RADIUS Protocol RADIUS AAA server
  AAA-server local LOCAL Protocol
  Enable http server
  http 192.168.10.2 255.255.255.255 inside
  http 192.168.10.101 255.255.255.255 inside
  http 192.168.100.2 255.255.255.255 inside
  No snmp server location
  No snmp Server contact
  SNMP-Server Community public
  No trap to activate snmp Server
  enable floodguard
  Permitted connection ipsec sysopt
  ISAKMP nat-traversal 20
  Telnet timeout 5
  SSH 192.168.10.101 255.255.255.255 inside
  SSH timeout 60
  Console timeout 0
  dhcpd dns 8.8.8.8 8.8.4.4
  dhcpd lease 3600
  dhcpd ping_timeout 750
  dhcpd outside auto_config
  Terminal width 80
  Cryptochecksum:7f9bda5e534eaeb1328ab08a3c4d28a
  ------------

  Do you have any advice? I don't get what's wrong with my setup.

  My DC is 192.168.100.2 and the network mask is 255.255.255.0

  The network configuration is configured to set the IP of the gateway to 192.168.100.1 (i.e. the PIX 501).

  I have about 50 + peers on the internal network.

  Any help is apprecciate.

  Hello

  You have a license for 50 users +?

  After the release of - Show version

  RES

  Paul

• PIX 501 for Cisco 3640 VPN router

  -Start ciscomoderator note - the following message has been changed to remove potentially sensitive information. Please refrain from publishing confidential information about the site to reduce the risk to the security of your network. -end of the note ciscomoderator-

  Have a 501 PIX and Cisco 3640 router. The 3640 is configured for dynamic map for VPN. The PIX 501 is set to pointing to the 3640 router static map. I can establish a tunnel linking the PIX to the router and telnet to a machine AIX on the inside network to the router. When I try to print on the network of the PIX 501 inside it fails.

  What Miss me? I added the configuration for the PIX and the router.

  Here are the PIX config:

  PIX Version 6.1 (1)

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  enable encrypted password xxxxxxxxxxxxxxxx

  xxxxxxxxxxxxx encrypted passwd

  pixfirewall hostname

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 1720

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  names of

  pager lines 24

  interface ethernet0 10baset

  interface ethernet1 10full

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside dhcp setroute

  IP address inside 192.168.1.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  No sysopt route dnat

  Telnet timeout 5

  SSH timeout 5

  dhcpd address 192.168.1.2 - 192.168.1.33 inside

  dhcpd lease 3600

  dhcpd ping_timeout 750

  dhcpd outside auto_config

  dhcpd allow inside

  Terminal width 80

  Cryptochecksum:XXXXXXXXXXXXXXXXXXX

  : end

  Here is the router config

  Router #sh runn

  Building configuration...

  Current configuration: 6500 bytes

  !

  version 12.2

  no service button

  tcp KeepAlive-component snap-in service

  a tcp-KeepAlive-quick service

  horodateurs service debug datetime localtime

  Log service timestamps datetime localtime

  no password encryption service

  !

  router host name

  !

  start the flash slot1:c3640 - ik9o3s - mz.122 - 16.bin system

  queue logging limit 100

  activate the password xxxxxxxxxxxxxxxxx

  !

  clock TimeZone Central - 6

  clock summer-time recurring CENTRAL

  IP subnet zero

  no ip source route

  !

  !

  no ip domain-lookup

  !

  no ip bootp Server

  inspect the name smtp Internet IP

  inspect the name Internet ftp IP

  inspect the name Internet tftp IP

  inspect the IP udp Internet name

  inspect the tcp IP Internet name

  inspect the name DMZ smtp IP

  inspect the name ftp DMZ IP

  inspect the name DMZ tftp IP

  inspect the name DMZ udp IP

  inspect the name DMZ tcp IP

  audit of IP notify Journal

  Max-events of po verification IP 100

  !

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  !

  crypto ISAKMP policy 20

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto key address x.x.180.133 xxxxxxxxxxx

  ISAKMP crypto keys xxxxxxxxxxx address 0.0.0.0 0.0.0.0

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac vpn test

  Crypto ipsec transform-set esp-3des esp-sha-hmac PIXRMT

  !

  dynamic-map crypto dny - Sai 25

  game of transformation-PIXRMT

  match static address PIX1

  !

  !

  static-card 10 map ipsec-isakmp crypto

  the value of x.x.180.133 peer

  the transform-set vpn-test value

  match static address of Hunt

  !

  map ISCMAP 15-isakmp ipsec crypto dynamic dny - isc

  !

  call the rsvp-sync

  !

  !

  !

  controller T1 0/0

  framing ESF

  linecode b8zs

  Slots 1-12 channels-group 0 64 speed

  Description controller to the remote frame relay

  !

  controller T1 0/1

  framing ESF

  linecode b8zs

  Timeslots 1-24 of channel-group 0 64 speed

  Description controller for internet link SBIS

  !

  interface Serial0/0:0

  Description CKT ID 14.HXGK.785129 Frame Relay to Remote Sites

  bandwidth 768

  no ip address

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  encapsulation frame-relay

  frame-relay lmi-type ansi

  !

  interface Serial0 / point to point 0:0.17

  Description Frame Relay to xxxxxxxxxxx location

  IP unnumbered Ethernet1/0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP nat inside

  No arp frame relay

  dlci 17 frame relay interface

  !

  interface Serial0 / point to point 0:0.18

  Description Frame Relay to xxxxxxxxxxx location

  IP unnumbered Ethernet1/0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP nat inside

  No arp frame relay

  dlci 18 frame relay interface

  !

  interface Serial0 / point to point 0:0.19

  Description Frame Relay to xxxxxxxxxxx location

  IP unnumbered Ethernet1/0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP nat inside

  No arp frame relay

  dlci 19 frame relay interface

  !

  interface Serial0 / point to point 0:0.20

  Description Frame Relay to xxxxxxxxxxxxx location

  IP unnumbered Ethernet1/0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP nat inside

  No arp frame relay

  dlci 20 frame relay interface

  !

  interface Serial0 / point to point 0:0.21

  Description Frame Relay to xxxxxxxxxxxx

  IP unnumbered Ethernet1/0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP nat inside

  No arp frame relay

  dlci 21 frame relay interface

  !

  interface Serial0 / point to point 0:0.101

  Description Frame Relay to xxxxxxxxxxx

  IP unnumbered Ethernet1/0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP nat inside

  No arp frame relay

  dlci 101 frame relay interface

  !

  interface Serial0/1:0

  CKT ID 14.HCGS.785383 T1 to ITT description

  bandwidth 1536

  IP address x.x.76.14 255.255.255.252

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  NAT outside IP

  inspect the Internet IP on

  no ip route cache

  card crypto ISCMAP

  !

  interface Ethernet1/0

  IP 10.1.1.1 255.255.0.0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP nat inside

  no ip route cache

  no ip mroute-cache

  Half duplex

  !

  interface Ethernet2/0

  IP 10.100.1.1 255.255.0.0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP nat inside

  no ip route cache

  no ip mroute-cache

  Half duplex

  !

  router RIP

  10.0.0.0 network

  network 192.168.1.0

  !

  IP nat inside source list 112 interface Serial0/1: 0 overload

  IP nat inside source static tcp 10.1.3.4 443 209.184.71.138 443 extensible

  IP nat inside source static tcp 10.1.3.4 9869 209.184.71.138 9869 extensible

  IP nat inside source 10.1.3.2 static 209.184.71.140

  IP nat inside source static 10.1.3.6 209.184.71.139

  IP nat inside source static 10.1.3.8 209.184.71.136

  IP nat inside source static tcp 10.1.3.10 80 209.184.71.137 80 extensible

  IP classless

  IP route 0.0.0.0 0.0.0.0 x.x.76.13

  IP route 10.2.0.0 255.255.0.0 Serial0 / 0:0.19

  IP route 10.3.0.0 255.255.0.0 Serial0 / 0:0.18

  IP route 10.4.0.0 255.255.0.0 Serial0 / 0:0.17

  IP route 10.5.0.0 255.255.0.0 Serial0 / 0:0.20

  IP route 10.6.0.0 255.255.0.0 Serial0 / 0:0.21

  IP route 10.7.0.0 255.255.0.0 Serial0 / 0:0.101

  no ip address of the http server

  !

  !

  PIX1 static extended IP access list

  IP 10.1.0.0 allow 0.0.255.255 192.168.1.0 0.0.0.255

  IP access-list extended hunting-static

  IP 10.1.0.0 allow 0.0.255.255 192.168.1.0 0.0.0.255

  extended IP access vpn-static list

  ip permit 192.168.1.0 0.0.0.255 10.1.0.0 0.0.255.255

  IP 192.0.0.0 allow 0.255.255.255 10.1.0.0 0.0.255.255

  access-list 1 refuse 10.0.0.0 0.255.255.255

  access-list 1 permit one

  access-list 12 refuse 10.1.3.2

  access-list 12 allow 10.1.0.0 0.0.255.255

  access-list 12 allow 10.2.0.0 0.0.255.255

  access-list 12 allow 10.3.0.0 0.0.255.255

  access-list 12 allow 10.4.0.0 0.0.255.255

  access-list 12 allow 10.5.0.0 0.0.255.255

  access-list 12 allow 10.6.0.0 0.0.255.255

  access-list 12 allow 10.7.0.0 0.0.255.255

  access-list 112 deny ip host 10.1.3.2 everything

  access-list 112 refuse ip 10.1.0.0 0.0.255.255 192.168.1.0 0.0.0.255

  access-list 112 allow ip 10.1.0.0 0.0.255.255 everything

  access-list 112 allow ip 10.2.0.0 0.0.255.255 everything

  access-list 112 allow ip 10.3.0.0 0.0.255.255 everything

  access-list 112 allow ip 10.4.0.0 0.0.255.255 everything

  access-list 112 allow ip 10.5.0.0 0.0.255.255 everything

  access-list 112 allow ip 10.6.0.0 0.0.255.255 everything

  access-list 112 allow ip 10.7.0.0 0.0.255.255 everything

  access-list 120 allow ip host 10.100.1.10 10.1.3.7

  not run cdp

  !

  Dial-peer cor custom

  !

  !

  !

  !

  connection of the banner ^ CCC

  ******************************************************************

  WARNING - Unauthorized USE strictly PROHIBITED!

  ******************************************************************

  ^ C

  !

  Line con 0

  line to 0

  password xxxxxxxxxxxx

  local connection

  Modem InOut

  StopBits 1

  FlowControl hardware

  line vty 0 4

  exec-timeout 15 0

  password xxxxxxxxxxxxxx

  opening of session

  !

  end

  Router #.

  Add the following to the PIX:

  > permitted connection ipsec sysopt

  This indicates the PIX around all ACLs for IPsec traffic. Now that your IPSec traffic is still subject to the standard rules of PIX, so launched inside the traffic is allowed to go in, but off-initiated traffic is not.