Hi,

The router has a very vanillia setup - traffic of all types flows through it without problem ? Unless the router blocks certain ports by default ??

It seems to be becuase I'm trying to NAT to a logical interface on the PIX. I was trying to seperate traffic from each other using virtual interfaces and VLANs. I'm not sure how secure it is giving a PIX a internet IP ??? Can't people hack these boxes easily when they are configured like that ?

Thanks

Ed

Hi Ed

First thing that you asked is how to trace traffic ?

-> Check your PIX syslog messages and see if client traffic is passing through your router and hitting PIX interface ?

->You can check the netflow traffic on the router by enabling "ip route-cache flow " and you can check the current traffic by "show ip cache flow". If you want to get the netflow data collected offline, you need to have some netflow analyser tool.

and you can troubleshoot where the traffic is getting bloacked and why ? could be any access-list that you have applied on router etc

Second thing that you have asked is :- is it safe to give public ip on pix outside interface ?

Yes, you can do this setup without any problem but you need to be clear about what trafic you are going to permit through PIX.

As fernando said if its client to site vpn setup you may need to enable NAT Traversal, as VPN and NAT by their basic nature donnt gel just like water and oil :)

best bet will be, give your pix a public ip and define your secuirty policies clearly and filter most of traffic on router only like private ips from internet etc.

HTH, please rate if it does

rgds

Hi,

I managed to get it working. I in the end gave the public IP to the physical interface. I was wondering if its slightly safer giving it to the logical interface ? But I wasn't able to get this to work.

My access lists are pretty clear now. I'm pretty anal on these things - but the access list on the router are very vanilla. You say filter private ip from the internet on the router? What do you mean by this ??

Also on the PIX how do I limit traffic to each group ?? I use the crypto isakmp match address command but then traffic drops completely and I get a group does not match SA errors?

Thanks

Ed

Hi

I was talking about various security controls which you can apply on internet facing router itself like private ips are not supposed to be present on internet cloud so filter them out on the router itslef i.e. block all the traffic hitting your internet router with private ips as source ...

similarly you donnt expect public ips allocated to your organisation to come as source, any internet incoming to your router , these public ips will always remain as destination only so block them as source ips at router (anti- spoofing technique)..

you can dig more about these controls , search for keywords "security best practises" at cisco.

rgds