Hi Josky,
Could you please tell me what code are you running on the PIX?
Also, could it be possible that I can take a look at the access-list and access-group commands you have configured.
If the answer is yes please do a show access-list and show access-group and send it or upload it.
Now if you are using code 7.x on the PIX you can use the Application-Aware Inspection Services with the new code
check the configuration example below:
Create a class-map for http inspection
pix(config)# class-map http-port
pix(config-cmap)# match port tcp eq 80
pix(config-cmap)# exit
Create an http-map to specify parameters for inspect http
pix(config)# http-map inbound_http
pix(config-http-map)# content-length min 100 max 2000 action reset log
pix(config-http-map)# content-type-verification match-req-rsp action reset log
pix(config-http-map)# max-header-length request 100 action reset log
pix(config-http-map)# max-uri-length 100 action reset log
pix(config-http-map)# port-misuse p2p action drop
pix(config-http-map)# port-misuse im action drop
pix(config-http-map)# port-misuse default action allow
pix(config-http-map)# exit
Create a policy-map for http inspection
* pix(config)# policy-map inbound_policy
pix(config-pmap)# class http-port
pix(config-pmap-c)# inspect http inbound_http
pix(config-pmap-c)# exit
pix(config-pmap)# exit
If necessary create a service-policy or use the default-inspection policy
pix(config)# service-policy inbound_policy interface outside
This ends up in the config as:
--------------------------------------------------------------------------
class-map http-port
match port tcp eq 80
class-map http-port8080
match port tcp eq 8080
…
http-map inbound_http
content-length min 100 max 2000 action reset log
content-type-verification match-req-rsp action reset log
max-header-length request 100 action reset log
max-uri-length 100 action reset log
port-misuse p2p action drop
port-misuse im action drop
port-misuse default action allow
…
policy-map inbound_policy
class http-port
inspect http inbound_http
class http-port8080
inspect http inbound_http
…
service-policy inbound_policy interface outside
Essentially this will cause the pix to block the IM/P2P applications while still allowing
normal traffic over port 80/8080.
also here is the link to PIX 7.0 and ASA CLI architecture. This should be a comprehensive
reference in configuring your 7.0 PIX at the CLI level.
http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_book09186a0080485008.html
Franco Zamora
