cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1437
Views
0
Helpful
2
Replies

Conduit to Access list converter tools

shamugalu1
Level 1
Level 1

We have PIX 515 running 6.3(3) ios with counduit statements. Is there any cisco tool that we can use to convert legacy conduit into access lists with minimum down time?

2 Replies 2

a.kiprawih
Level 7
Level 7

Hi,

There is a tool called The PIX Outbound Conduit Converter (OCC) available to contracted customers from the Cisco.com Software Center PIX directory (registered customers only) .

filename: occ-121.zip

desc: PIX Firewall Outbound Conduit Converter Binary version 1.2.1, for Windows

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_field_notice09186a00801d3621.shtml

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_upgrade_guides09186a0080369ee2.html#wp1472070

This tool facilitates the conversion of conduit and outbound commands to Access Control List configurations. However, due to the different nature of these access control methods there may be some changes to the actual functionality and behavior put in place so this must be considered an aid and only a starting point. All configurations converted by the OCC tool must be verified and tested by the network security administrators familiar with the network in question and its security policies before being implemented.

Limitations:

The OCC tool does not support alias and policy nat commands. The OCC tool does not convert configuration combinations of both an exposure of all addresses behind an internal (higher security) interface, and either a default route to the same interface or commands enabling RIP/OSPF.

The Cisco.com Output Interpreter (registered customers only) provides a web interface that also performs the conversion. Ensure word wrapping is off in your terminal client and paste the complete captured output from write terminal or show running-config into Output Interpreter. To use Output Interpreter , you must be a registered user, be logged in, and have JavaScript enabled. The same caveats regarding verification and testing hold true for Output Interpreter conversions.

Rgds,

AK

I got it, hopefully it will help

Thanks

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: