Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

PIX Conduit vs Access-lists

On the old PIXes such as the classic, you have static and conduit commands to open ports to the outside. I know on the new versions, you can use access lists paired with static commands to open ports. You can also use conduits. I have two questions.

1. If you are using numbered access-lists wouldn't you be limited from 100-199 access lists?

2. Which way is better? Seems to me that conduit reduces complexity since you don't have to apply it to an interface. It knows what to do based on your static.

Thanks.

4 REPLIES
Silver

Re: PIX Conduit vs Access-lists

Conduits are said to be on their way out in future version of pixos, using ACLs is recommended to future proof your configuration.

ACLs also reduces training time, as they are highly similar to those used by IOS (IOS differs by using inverse subnet masks)

New Member

Re: PIX Conduit vs Access-lists

How about the 100-199 extended ACL limitation?

New Member

Re: PIX Conduit vs Access-lists

I believe you are thinking in terms of conduits which are not applied to interfaces. ACL's are applied to interfaces. You use the access-group command to apply an ACL to an interface. You allow all your access inbound from your ouside interface with one ACL. The same with your outbound access from your inside interface. As an example:

Access-list 101 permit tcp any host 192.168.1.1 eq ftp

Access-list 101 permit tcp any host 192.168.1.2 eq www

access-group 101 in interface outside

Access-list 102 permit tcp 192.168.10.0 255.255.255.0 any eq www

Access-list 102 permit tcp 192.168.10.0 255.255.255.0 any eq ftp

access-group 102 in interface inside

You can have as many ports open between interfaces, they just are all in one access-list that is applied to an interface vs separate conduits that are not applied to interfaces.

HTH

RJ

New Member

Re: PIX Conduit vs Access-lists

Also you do not have to use numbers for your access lists you can use anything. You should not mix conduits and access lists on the same system. Access list can also be run in turbo mode for much faster performance on PIX's that support that function ie anything but a 501.

343
Views
0
Helpful
4
Replies
CreatePlease login to create content