PIX 501 configuration

Unanswered Question
Nov 8th, 2010

Hi - and thanks in advance for your help.

There's something I'm doing wrong with the basic configuration of this older PIX 501, and I don't know what it is...  It seems to me it should be working, and indeed it was working for a short while, and then stopped working inexplicably. 

Now I can't even ping any IP outside, not even the next hop --- YET, once connected, the outside world can ping it!

And so I was hoping someone could look at the "show run" and tell me what is missing before I rip my hair out.

Here's the show run, and thanks again for your help -

(PS - the real outside IP was replaced by A.B.C.D, and the next hop by A.B.C.E)

-------------------

PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password 7qqHBeDL51oM/AKL encrypted

passwd 8WAU9VgeZbq1ZOeK encrypted

hostname fire

domain-name xxx.pri

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol pptp 1723

fixup protocol rsh 514

fixup protocol rtsp 554

no fixup protocol sip 5060

no fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside A.B.C.D 255.255.255.252

ip address inside 192.168.6.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) A.B.C.D 192.168.6.9 netmask 255.255.255.255 0 0

conduit permit tcp host A.B.C.D eq pptp any

conduit permit icmp any any

route outside 0.0.0.0 0.0.0.0 A.B.C.E 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet 192.168.6.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

banner exec Private Network - Buzz off!

banner login Private Network - No Access!

Cryptochecksum:488eebb0a68315fabc877297138c0e44

: end

fire#

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 0 (0 ratings)
binhkdinh Fri, 11/19/2010 - 15:15

First of all, you may want to use access-list instead of conduit. Quotes from a Cisco CmdRef document: "the conduit command has been superseded by the access-list command. We recommend that you migrate your configuration away from the conduit command to maintain future compatibility."

Second, is the 192.168.6.9 live?

static (inside,outside) A.B.C.D 192.168.6.9 netmask 255.255.255.255 0 0

Try these initially, then tighten the rules (ACL) when things are working:

no conduit permit tcp host A.B.C.D eq pptp any

no conduit permit icmp any any

!

access-list acl_inbound permit ip any any

access-list acl_outbound permit ip any any

access-group acl_inbound in interface outside

access-group acl_outbound in interface inside

!

icmp permit any outside

icmp permit any inside

!

Hope that helps.

Just modified a command.

-B

Actions

Login or Register to take actions

This Discussion

Posted November 8, 2010 at 8:29 AM
Stats:
Replies:3 Avg. Rating:
Views:2322 Votes:0
Shares:0

Related Content

Discussions Leaderboard