YOUR PIX 515 failover

Similar Questions

• Question of pix 515 2 ISP

  I have a client with a 515 cisco pix. Is it possible to have 2 separate configs on the pix and power quickly select what config you want to begin? My client had problems lately with his main ISPS who happens be the fastest connection between the 2 and when it comes down there do intellectual property changes on the pix to perform the failover manually.

  Ok..

  I have a client with a 515 cisco pix. Is it possible to have 2 separate configs on the pix and power quickly select what config you want to begin?

  -YES, YOU CAN CONFIGURE YOUR PIX 515E IN MULTIPLE CONTEXT

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808d2b63.shtml

  My client has had problems lately with its main ISP which is be the fastest connection between the 2 and when it breaks down there manually make changes to intellectual property on the pix to make the transition to the

  -YOU CAN CONFIGURE "FAI DOUBLE FEATURE."

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml

• PIX-515E-R-BUN MEM upgrade with PIX-515-MEM-32

  Hi all

  is it maybe possible to upgrade the PIX 515E - r

  with this release of PIX-515-MEM-32, without having to pay

  for all PIX-525-SW-R-UR = update license.

  Concerning

  Richard

  The PIX will recognize this new memory but the configuration is not supported. The upgrade of UR's memory, but also an update of license for several interfaces, failover, etc... Unless you want to add these features to your PIX, it is not necessary to upgrade memory. 32 MB is more than enough for a PIX 515R.

  Does that help?

  Scott

• PIX 515 adding a second DMZ

  Hello

  This is the specification of our PIX:

  Cisco PIX Firewall Version 6.2 (2)

  Cisco PIX Device Manager Version 2.0 (2)

  Updated Saturday, June 7 02 17:49 by Manu

  Firewall of the hours - days.

  Material: PIX - 515, 32 MB RAM, Pentium 200 MHz processor

  I28F640J5 @ 0 x 300 Flash, 16 MB

  BIOS Flash AT29C257 @ 0xfffd8000, 32 KB

  0: ethernet0: the address is 0003.6bf6.74a2, irq 11

  1: ethernet1: the address is 0003.6bf6.74a3, irq 10

  2: ethernet2: the address is 00a0.c944.395b, irq 9

  Features licensed:

  Failover: disabled

  VPN - A: enabled

  VPN-3DES: enabled

  Maximum Interfaces: 3

  Cut - through Proxy: enabled

  Guardians: enabled

  URL filtering: enabled

  Internal hosts: unlimited

  Throughput: unlimited

  Peer IKE: unlimited

  Is it possible to add a second DMZ simply by adding another network card to the system? If this is not the case, what I have to do to get a second DMZ?

  Kind regards

  Alan

  You have already 3 interfaces, and your license only allows 3 (that you run limited license). Read the line of your worm above show: maximum Interfaces: 3

  You must update your Unrestricted license, then you can have up to 6 interfaces.

  It will be useful.

  Steve

• PDM with PIX 515 does not work

  I just upgraded our PIX 515 of 6.1 to 6.2. I also added support FOR and loaded the version 2.1 of the PDM. I am trying to browse the MDP, but I can't. What Miss me?

  Hello

  have you added the following lines to your config file and have you used HTTPS to access the pix (http is not taken in charge, only https)?

  Enable http server

  http A.B.C.D 255.255.255.255 inside

  A.B.C.D is the ip address of the host from which you are trying to reach the pix with the pdm.

  If you're still having problems after the addition of these two lines, you might have a look at this page:

  http://www.Cisco.com/warp/customer/110/pdm_http404.shtml

  Kind regards

  Tom

• PIX - 515 does not identify Tokenring Interfacecard

  Hello

  I installed a PIX-1 TR interface in the PIX 515. Start ok, 'answer' no configuration. SH LVE and sho int etc. presents only the build Ethernet0 and Eth1 but no interface tokenring.

  HS release looks like as follows.

  Thanks Ruedi

  pixfirewall # sh ver

  Cisco PIX Firewall Version 6.2 (2)

  Cisco PIX Device Manager Version 2.0 (2)

  Updated Saturday, June 7 02 17:49 by Manu

  pixfirewall until 10 mins dry 14

  Material: PIX - 515, 32 MB RAM, Pentium 200 MHz processor

  I28F640J5 @ 0 x 300 Flash, 16 MB

  BIOS Flash AT29C257 @ 0xfffd8000, 32 KB

  0: ethernet0: the address is 0003.6bf6.a8a9, irq 11

  1: ethernet1: the address is 0003.6bf6.a8aa, irq 10

  Features licensed:

  Failover: disabled

  VPN - A: enabled

  VPN-3DES: disabled

  Maximum Interfaces: 3

  Cut - through Proxy: enabled

  Guardians: enabled

  URL filtering: enabled

  Internal hosts: unlimited

  Throughput: unlimited

  Peer IKE: unlimited

  Serial number: 405341167 (0x182903ef)

  Activation key running: xxxxxxxxx

  Modified configuration of enable_15 to 13:11:47.490 UTC Tuesday, December 23, 2003

  pixfirewall #.

  Hello

  Token-Ring is no longer supported, I think since version 6.0.

• DNS traffic blocked after PAT - PIX 515

  I have PIX 515 with 3 named NIC (internal, external, dmz)

  I have 2 servers (Exchange and Windows 2000 with SMTP) in the demilitarized zone.

  I currently have a static command pointing to doamin for exchange Server IP address in the DMZ.

  I wanted to PAT on the IP address of the e-mail domain so that the configuration will look like as follows.

  The IP field will be used for the global IP

  all pop3 for global ip traffic will go to Exchange

  all www for the global IP traffic will go to Exchange

  all smtp for global ip traffic will go to the Windows 2000-based SMTP relay (SMTP relay is configured to send the e-mail received in exchange Server)

  I hosted DNS udp and tcp traffic to the servers.

  before pat, the server can use DNS to resolve IP domain e-mail and send mail to the Internet.

  As soon as I PAT the Internet e-mail delivery stops.

  When I did an NSLOOKUP command returns an error indicating that the DNS server cannot be resloved.

  The servere DNS used by these 2 servers are servers DNS of ISP.

  Is there any concern when you PAT.

  Thank you

  Hello

  I found the problem:

  for now, your dmz servers can go to the internet with pop3, smtp, and www. Only for these protocols is a (static) translation to provide in the config file.

  You will need to will provide you a translation for other protocols (for example, dns) also. This can be accomplished with one of the following two things:

  create a nat - pair overall for the DMZ for outdoor

  NAT (dmz) 1 0.0.0.0 0.0.0.0

  Global (outside) 1 200.100.100.168 (already exists)

  create a static translation for each of the other protocols (next to pop3, smtp, www), you want to pass from the dmz to the internet (you already did that for www, pop3 and smtp).

  Kind regards

  Tom

• PIX 515 limited software technical spec

  I couldn't find a complete tech

  specifications of the restricted part of the software on the PIX-515-R-DMZ-BUN, which is this chassis seem to bear no x interfaces, y amount of RAM and Z no users inside. X = 3, Y = 32 meg, which is Z and are there restrictions more and more of this?

  Rgds

  Martyn Beck

  The only chassis PIX that has limitations of the user is the 501 PIX which comes with a 10, 50 or unlimited user license. The 515 has not any restrictions on the number of internal users that this number is rather arbitrary. Instead, we use the throughput and simultaneous connections that are roughly 190 MB of throughput and 130 000 simultaneous connections. Also the license restricted on the 515 does not failover of any kind.

  Here is a link to 515E data sheets:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_data_sheet09186a0080091b15.html

  I hope this helps.

  Scott

• Registration of pix 515 "authorized connections."

  Can someone tell me if it is possible to connect to a syslog "allowed connections."

  We have lists of access internal servers behind the Pix 515 with port forwarding.

  We want to connect all connections from internet to the external IP, two connections permits and denied.

  logging trap debug, does not record the allowed connections. I tried this. Is there another way this?

  Thanks in advance!

  Gregory Manglaris

  Network engineer

  [email protected] / * /.

  The pix records connections. These present yourself as a syslog message #30213 information and look like this "outside:207.207.58.100/32792 (207.207.58.100/32792) at inside:w.x.y.z/80 (a.b.c.d/80) built 529605 for incoming TCP connection.

  The IP address represented by w.x.y.z. will be the internal address of your host and the IP address represented by a.b.c.d is the public address of this host.

• question static pix 515

  I have installed a pix 515 at home on my broadband for the test connection. I was wondering if it is possible to use the static command to map an internal on the dhcp address assigned by ISP. I have reverse DNS client installation to map the dhcp WAN attributed to a public dns server address.

  Example:

  outside interface0

  Interface1 inside

  IP address outside dhcp setroute

  inside the 172.16.0.1 IP address

  IP route 0.0.0.0 0.0.0.0 dhcp

  Thank you

  Assuming you have something like:

  > nat (inside) 1 0 0

  > global (1 external interface)

  for your outgoing traffic, you can proceed as follows for incoming traffic:

  > static (inside, outside) tcp interface 80 172.16.0.2 80 netmask 255.255.255.255

  It maps all TCP port 80 package intended for the PIX outside interface to the internal server at 172.16.0.2 on port 80. The keyword "interface" means interfaces external IP address. You can add as many of these port mappings as you want. The ports must be the same either, you can map port 80 to port 345 if you wish.

• MM, pix 515 and mac filtering

  I have an application called MeetingMaker, located at the back of my pix 515 that is used off site by 5 users. Since accessing this program on the internet, and users can have dynamic addresses, it is possible to filter by mac address somehow to allow access through the firewall to the app? Thank you.

  MAC addresses not browse the limits of layer 3. In others, your MAC address of clients cannot be seen or known once the traffic passes through the default router for that subnet. So the answer to your question is 'no '.

  You can use AAA to handle this. How your clients connect to the server? (port/application)? If its HTTP/S, the Pix can check this name of user and password before allowing access. If it is a part on request/port, you can still use authentication by requiring them to connect to the web server out there first. This will cause the Pix to authenticate by using the challenge of browser, and the Pix can be configured to allow connections to the hosts authentiated.

• VPN for PIX 515 allowing access to a single host

  I have already setup on my PIX 515 a VPN connection, which allows the user to connect to our network via a cisco VPN client to access network resources.

  I want to configure now is an another VPN connection that external users can use but would only allow access to a host.

  E.g. I would like to VPN in my site but would be allowed to access the 10.1.1.1 on my network.

  How can I do this? What I have to install VPNGROUP another and somehow an access list to allow only traffic to a host of configuration. Can anyone help with the correct syntax for the PIX.

  Thank you

  Scott

  You will now have a bunch of commands "vpngroup" in your PIX, simply go into config mode and add more commands 'vpngroup' but with a different groupname. The VPN client then uses this group name to connect to the PIX.

  Another way to allow only access to a host for this PIX is to split tunnelling on this group, as well as in the tunnel of split ACL set only as a host.

• PIX 515 6.1 (1) crashes every night

  We have a PIX 515 E Firewall (failover) with a simple configuration to allow web traffic only from inside. PIX with three interfaces ethernet and the DMZ is rarely used for specific needs. A www server is hosted with authentication through aaa for incoming users inside.

  For the last week, PIX crashes end each evening. No traffic doesn't cross the pix and we cannot ping all devices of pix as well. There are a lot of "no buffers" counts seen in all the PIX interfaces. The CPU usage is about 21%.

  Can anyone help to determine if this could be a hardware problem?

  Best regards, Murali

  Hi Murali,

  I'm not aware of any problem with the hardware, but there could be a software bug. I suggest that you open a case with cisco tac.

  or you can upgrade to 6.1.4 which has fix for most of the bugs.

  Thank you

  Syed

• PIX 515 no traffic on the new IP address don't block

  We have received a new range of ips 213.x.x.x/28 from our ISP. They are routed through our existing entry door 92.x.x.146.

  The problem:
  We can not all traffic to the pix on the new 213.x.x.x/28 range.
  -If we try to ping 213.x.x.61, we get the lifetime exceeded.
  -ISP Gets the same thing of their router.
  -ISP tries ssh and gets no route to host.

  The ISP has ticked then double the Routing and the MAC address of our external interface. They are correct.

  The strange thing is that we cannot see THE log messages about the new range of incoming connection attempts. The Pix is running at the level of the journal 7.

  Does anyone have an idea what could be the problem? or suggestions for debugging the issue?

  Excerpt from config:
  7.0 (7) independent running Pix 515
  outside 92.x.x.146 255.255.255.240
  inside 192.168.101.1 255.255.255.0
  Global 1 interface (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Route outside 0.0.0.0 0.0.0.0 92.x.x.145 1
  Access-group acl_out in interface outside
  acl_out list extended access permit tcp any host 213.x.x.x eq www
  acl_out list extended access permit tcp any host 213.x.x.x eq ssh
  static (inside, outside) 213.x.x.61 192.168.101.99 netmask 255.255.255.255
  ICMP allow any inaccessible State

  192.168.101.99 is a test with http and ssh linux server

  Any help much appreciated.

  PM

  dsc_tech_1 wrote:
  I have spoken to the ISP and confirmed the MAC address of the outside interface Ethernet0
  
      ISP says
  
      ...we are sending this correctly to your pix, you should see any traffic destined for a 213.x.x.0/28 address hit your interface at 92.x.x.146/32
  
  Yes 217.x.x.81 and 217.x.x.82 are routers owned by our ISP.
  Is there anything else I can ask the ISP in terms of testing/debugging? I've run out of ideas.
  

  If the routers are owned by your ISP, then the fault lies with them. They have a routing loop in their network and that's why packages are not your firewall. You have them shown the traceroute?

  They must focus on the routeurs.81 et.82 to establish why the packets are looped between these 2 routers. Until they fix this packet will never get your firewall.

  Jon

• How to block applications from Instant Messaging (socks Protocol) on my pix 515

  I would like to block all traffic application instant messaging on my pix 515. Some of them use the socks Protocol. Can someone help me to block these applications or SOCKS protocol on my pix 515?

  Concerning

  It was just answered by a thread below.

  MSN_Messenger_tcp tcp service object-group

  Description MSN Messenger tries to use these ports

  port-object eq www

  port-object eq 1863

  object-port 7001 eq

  the MSN_Messenger_hosts object-group network

  host Description MSN Messenger feeds

  object-network 65.54.195.0 255.255.255.0

  object-network 65.54.225.0 255.255.255.0

  network-object 65.54.226.0 255.255.254.0

  network-object 65.54.228.0 255.255.254.0

  host of the object-Network 65.54.240.61

  host of the object-Network 65.54.240.62

  network-object 207.46.104.0 255.255.252.0

  object-network 207.46.108.0 255.255.255.0

  object-network 207.68.171.0 255.255.255.0

  access list acl-inside tcp refuse any object-group MSN_Messenger_hosts-group of objects MSN_Messenger_tcp

  This applies to an acl on your inside interface.

  Patrick