Help!! PIX 515

[danderson]

I'm new with the PIX and don't know how to block ports. I'm using the CLI and need to block certain ports to avoid the mess with the blaster worm.

Can anyone tell me what to type in after I do the config t that will block these ports?

Thanks.

[bdube]

Hi Don,

Unfortunately, it's not just a simple command you have to enter. It's probably many commands, and the case is worst if your PIX has already access-list (PIX's filtering function) configured on.

But, we must begin at the beginning. Do you have some servers in the DMZ or inside which are accessible from outside? If yes, those one should be configured to leave only the needed ports, i.e. port TCP 80 for Web. If no, don't worry about your server security.

Ben

[danderson]

I'm not worried about my servers on the inside of the firewall. However the problem is that I have dial-up access to those servers. I'm afraid someone will dial in to my network (which is part orf a campus area network) and affect other servers in the campus.

[bdube]

Don, you don't tell us how your users are dialing in, through a specialized access server located in the DMZ, which is a good place, or directly to the servers with MS RAS. The last case cannot be helped with the PIX.

My first impression, all servers accesibles from outside, Internet or RAS, must be patched. It's the price to pay with MS servers as public servers.

If i can help you with the PIX, i'm in vacation, and we have electricity in Quebec. ;-)

Regards,

Ben

[danderson]

All my servers have been patched and updated with the latest antivirus software. However, we do allow users to dial in via PCAnywhere to a PC that is part of our network. We allow them to do this in order to access files on the network and to check their e-mail from home, hotels, etc. I fear someone is dialing in and "releasing" the worm in that manner. As I said, I am not concerned about MY servers, but the campus network administrator is telling me that I could potientally spread the worm to those servers on the campus network that has not been patched. My network is one of about 12 networks that are on the campus network. Each individual network is independantly administered by its own administrator. I was asked by the campus network administrator to "block" the ports in question on my firewall.

I realize that I'm probably not providing a lot of information, but as I said, I just recently took over the administration of my network and am totally unfamiliar with Cisco's IOS.

Thanks for all your attention and help in this matter.