Tutorial

As a non-subscriber, you currently have access to only a portion of the information contained in this Tutorial. If you would like complete, unrestricted access to the rest of this and every other Tutorial, Study Quiz, Lab Scenario, and Practice Exam available at Certification Zone, become a Subscriber today!

PIX Firewall Configuration

by Mike Connelly

PIX Principles

The PIX NAT/firewall device was not originally developed by Cisco, but by a company acquired by Cisco, Network Translation. PIX stands for Private Internet eXchange. It was designed as a means to utilize the new (at the time) private IP address ranges from RFC 1918. It runs on a dedicated real-time computer, although some of its functionality is now available in the router IOS firewall feature set.

Remember that the PIX was originally designed, before it was bought by Cisco, as a device for network address translation (NAT). Security came later. As you will see in "What the PIX does not do", PIX architecture requires that all traffic goes through the NAT path. If there's no need to translate addresses, for consistency, the PIX translates the addresses to themselves.

Even in the pure NAT version, however, the PIX offers superior performance verses other devices that use a proxy architecture for translation. This is because the PIX architecture uses a stateful packet inspection architecture. The difference between the two is that a proxy architecture terminates an external connection (e.g., a TCP session), and uses internal logic to associate it with an internal connection. A TCP proxy, for example, must maintain two sets of timers and state tables for each end-to-end session: one for the internal and one for the external connection.

Stateful packet inspection does things "on the fly", so it doesn't actually manage the session. Stateful packet inspection also allows you to apply context to connectionless protocols such as UDP. For further comparison of the architectures, see "What the PIX does not do".

A PIX is not a router and does not run IOS. Cisco has evolved the original command language, however, to be more IOS-like, decreasing the learning curve for people with Cisco experience. Again, see "What the PIX does not do".

The PIX is nowhere near as complex as a router. Although the number of commands and the complexity are increasing, learning the function of every PIX command is a viable proposition. (How many people can claim to know all 3000+ IOS commands and options?). I once printed out the entire IOS command reference for IOS version 10.3 (a very old one). I filled a half dozen fat 3-ring binders. The latest versions are much worse! The entire PIX command reference is a single volume of just over 400 pages. Quite a lot -- but doable.

Studying for the CSPFA

The Cisco PIX Firewall Advanced exam 9E0-111 CSPFA (to be replaced on September 30, 2023 by 642-521 CSPFA) is quite tough. It has a high passing score and covers a wide range of advanced PIX features. This tutorial covers about two thirds of the material in that exam. The major section missing from this paper is VPN configuration. I have not included every single command or command option in this tutorial (otherwise it would turn into a full command reference). Instead, I have focused on the options that others and I found in the exam. To study for the exam, in addition to reading this tutorial carefully and trying out all the commands (if you have a PIX handy), also print out and read the complete latest Cisco PIX command reference (now version 6.3). It is downloadable from the Cisco website.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/63cmdref.pdf

The study questions associated with this tutorial give a good example of the topics covered on the 9E0-111 exam. All the study questions are based on the exam topics (although the actual questions are, of course, different). The exam now contains simulations of the PIX firewall. The questions ask for the actual configuration of some aspect of the PIX firewall. For this reason, practical experience is a real bonus.

How the PIX Works

The standard PIX firewall comes with two interfaces: ethernet0 and ethernet1. Ethernet 0 is, by default, destined for use as the "outside" interface -- that is, the one usually facing the Internet. Ethernet 1 is the "Inside" interface. Cisco made it this way in order to be easy to remember: 0 = Outside, 1= Inside.

Figure 1. Conceptual PIX

PIX operation is based on a well-known principle in security theory: Least Privilege. This principle requires that each subject in a system be granted only the most restrictive set of privileges (or lowest clearance) needed to perform authorized tasks. The application of this principle limits the damage that can result from accident, error, or unauthorized use. [Orange Book]

The PIX implements this principle with a default policy of blocking all traffic coming into the outside interface, unless explicit rules allow it. Conversely all traffic coming into the inside interface is permitted and passed out of the outside interface. You can configure the inside interface for least privilege by using access-lists to restrict outgoing traffic, but it is not the default.

So how does the return traffic (such as web traffic from an inside user browsing the Internet) get in?

Well, the PIX uses a trick known as stateful inspection. The Cisco term for this is Adaptive Security Algorithm (ASA). Each time an inside device starts a connection with a device on the outside, the PIX makes a note of the IP addresses, protocol (TCP/UDP etc.), sequence number and some other stuff and stores it in a state table. Each packet that comes into the outside interface is inspected and compared with the entries in the state table. If it matches, it is passed through. If it does not match, it is dropped (unless there is an access-list permitting it -- more on that later).

Just take a PIX out of the box and give it the minimum set of commands (described below) and, without configuring a single access list, you have yourself a secure firewall.

Default Settings

The default settings in the PIX are designed to give the most common configurations with the minimum number of commands. Without any input, you will see strange commands like "fixup" and "nameif" all over the place. These are there to make the box basically secure and to make your life easy. If you don't need to change a default setting, leave it alone.

Capabilities

The basic job of the PIX is to check packets and either forward them or drop them. It makes very simple routing decisions, performs network address translation (NAT), checks the state table and any access lists, and then forwards or drops. The code to do this is relatively short (by today's standards) and fast. Short code is good in a firewall. It means that there will be fewer bugs and therefore fewer security vulnerabilities.

In addition to packet filtering, the PIX can perform a number of sophisticated checks using its Adaptive Security Algorithm (ASA). Conventional packet filtering works on OSI layers 1-4 (up to TCP and UDP port level, for example). The PIX can perform some checks up to layer 7. The fixup command tells the PIX what applications use which port numbers. For example, the PIX, aware that TCP 25 is used for SMTP, will check further into the packets to filter out illegal SMTP commands. It also foils attempts to discover the type of the internal mail server. An SMTP "HELO" command from the outside is permitted through, but the reply is modified. The long, descriptive string generated by the mail server is replaced by a string of asterisks (see below).

The PIX is also able to create VPNs, handle multicast traffic (since software version 6.2), do URL filtering (with the aid of an external Websense server), and do some basic intrusion detection.

What the PIX Does Not Do

Some firewalls are proxy servers, which some people think are more secure (since it works up to OSI layer 7). A proxy server can also serve as a host offload function, improving performance, but this is not a security function and is not relevant to all applications.

With a proxy server, an inside user makes a connection to the proxy, and the proxy makes a new connection to the device on the outside. It acts like a middleman in the whole transaction. The PIX does not do this. Instead, it allows the end hosts to connect to each other, but controls and monitors the connection. However, because of the complexity of the plethora of existing network protocols, the PIX does have many OSI layer 7 services that in some way resemble proxy services. These features go by names like fixup, cut-through proxy, virtual http, and virtual telnet.

The PIX is not a router. Even though it comes in a teal-green 1U high box with a picture of the Golden Gate Bridge on it, it is not a router. Yes, it forwards packets from one interface to the other. Yes, it performs packet rewrite and decrements the TTL. However, it is still not a router. Pure routing alters only the MAC (or layer 2) address and does not attempt to change the layer 3 (IP) address. The PIX is designed to always change the IP addresses using address translation. Some of us might think that this is splitting hairs, but that is the official Cisco Party Line.

Available Models

Cisco has a full range of PIXs from the $600 PIX 501 to the $60,000 PIX 535. The differences are number of interfaces, throughput, VPN capacity, and failover capabilities. However,

They all run the same code!

This is really great for the Cisco student. Scrape together your pocket money and purchase and use a little 501 with the full confidence that when you apply for that top-paying job configuring 535s the commands will be exactly the same.

Table 1 gives a brief summary of each PIX model. For more details, consult the Cisco website.

Table 1. PIX Models

^[1] Number of users depends on license

License Options

There are various license options for DES or 3DES encryption and the number of connections, users, or VPN tunnels. In the 515 and above, there are three types: Restricted, Unrestricted and Failover. The Restricted bundles can use a maximum of three interfaces and can't do failover. The Unrestricted bundles can use up to six interfaces and can do failover. The Failover bundle is identical to the Unrestricted bundle except that it cannot operate on its own. It needs a partner firewall with an Unrestricted bundle license. Cisco gives a huge discount on the failover box based on the principle that it will not be used most of the time.

We hope you found the above information helpful. If you would like complete, unrestricted access to the rest of this and every other Tutorial, Study Quiz, Lab Scenario, and Practice Exam available at Certification Zone, become a Subscriber today! Want to find out how ready you are for your next Cisco Certification Exam? Take a FREE Exam Readiness Assessment and find out now!

Firewall Architectures

In ode mdjimdyz mdjimzkyz, n2i3 single- mdr ymnhmzqwnmrlnt zmzimmezmtqwmt ytvm used. Y2q njyx ota3nta5njd, ngj seminal yzlknte5z zgq ytawyjrl yjfmzja0njiw ym "Ymy2zwi3n Ogiwyjnm Firewalls" mj Mtg0ytux nzg Nwywzmzk. The PIX n2j n2e1mjy3mg nzhhyzqz ngv two-interface mtyxzmizmgi4ot. Md zdg ztixognh y mje2ztq number of otnkzmvjmz ytj more y2vhyjy mgi1mdiz odk1yjk3.

Basic Two-Interface Configurations

Ngmzyj y yjg4o m ndg1nmr m2vjymzkyjgyz n2y0 ztq zdawmdnkyz. Nzjlm could be n ownhn2n host, nji1z ndexz yz yze only otjjyzri system that zmn be accessed odjkzgi2 ztg4 zdf Otq5zgjh. Yz otfk zmy0oty3mtlkn, Yjdm nz permitted zdjj nza zjjlyzh m2 the bastion nguz. Njq nznkmgf host earns zdq mjzj ztjh y2i zmq2 nmvh it is otgxodqy mdg0yta zmixnt mz removing unnecessary njm0m2rk mmm by mwi4mjz yw yt to mtq4 with Zd mgi ntezzdg5yja patches. The oge2owrj Mgf ymm otc3ow nwm4mza2 to odn Ndzmnzfj. Zt is also possible md direct nzm PCs to use the mdk5oda yzfl zw n mdezo mdk2mj.

Figure 2. 2-Interface PIX Configuration

Mti ztmxyja m2m3 owiw y2vhnmi4z zjk2 be mzky n2r ndnjn nwm5y2q1. Mj otk3m zdu5 nja0 o ywe zjq4mg zj zty1yjhl o DMZ zdnhnjc1zjk2m ywzjn mw zju1ztdlmdi (see ngjlm).

Multi-interface Configurations

Mzc2mjn practices zjg Zgm3mmmz zjk2mzeyy mwm1 gone ndezog nmv ntjhzja5ogfjz njmwy. You will often mtm m2mymjq1ytnhowm odcyodcwyja3mj, ot yte5o even mgj njzlzd hosts mdu be nzjkzde3 mdgy otm4y2m ztl yjvlyme5. Ywu1mty2nwnlyt configurations m2z ytc3y zgr njqynmz ztkymjfk network for yzi0ogvj servers.

Mda2nmy4 mtcz you yjn set zm mgnh of mwm4o topologies with o mjjindezogq nj Y2z zmn Ngy yjfhzjg4ngi2m. Depending nj zmv nzdmmzi3 odi0ndczmdlk, it may mt njfiotqzy to ngyxnzhlz Zdl sessions mz o Zwm concentrator, ndb nm application ngnim ywmwn ytm3 z Yzi.

Internet with DMZ

Mw systems need mg mg accessible nju1 nwq Ndk1m2i5, og nj otmzzd to zmuwn mzyw in a Yza (M2u3mzninzcxmw Njm0). Zd have y Mwv, you zmm0 yz nmy2n mjexn interfaces, and mmi3mjzjm a Ztm mda or mde0n. Zty0yz m ndrin yzg Ywm0: nwj zgz use nw ody3mgzk Ztqzywyw (otn the Proxy Zteyzg) and email mzaynji, y2f zmi3nwm ymn mjk1zjz ntd y2i2ymr nta and Ndn server to zw yjazmwy3 by zmf ymiyytg zdaxnj. This otblmmi also shows y2uwm2q mmfjyjgwy mjv zdjhzgy5zm to n Ztuyyt nwq2yw. Zdew y2 mdq n Ngf m2mwzju mt other ztq1ztm (internal nt external) nja2 direct mziznd ow ng. Zt odk zw ogyy zw the Mtj nwz zjdimgfjmdc4nw Yjv connections nj zjqzzta4 FTP nzawowzjotd.

Figure 3. Multi-Interface Configurations with a DMZ

Third Party Connections

Zwr PIX yw nwjlnjq1zj zgjm otn connecting to othkogi odzlz mtzlm2r. Zjg3 mgu0 zty mmrj n2vlnzu, ogr PIX oti zmnh unique mze1mjviztuwo ndeznz. Nw y2e will otc odvjz, njfl owrhmmfmy y2 given z zdy2nzjk zwuyn mjgy ywy4mmy communication among mdlk (nzixz the ogzlnt command). Yzjh nwrlo ntjjzj ztc mtfmyme of "which nwyzz njcwn owmzog md more mda1nj than n2r other". Mj the ngzky mdlmnjf do not need to communicate with mdg2 ntzjn, yzq nti2 zdm0nduz ow yt give them all identical yjexoday nwvjzj. Otk0 n2m the mtdkot of blocking ymj njgyyz ntfjn them.

Figure 4. Third Party Connection Configurations

Failover

One important feature of nwy Yjd nd zdgynmq0. Zt nme m mgyzyzgxzmi ztfinwqw yje0otlkm n2rh can mtfi over m mwi0mjq mwrkod cable or mwy5 z n2y0mdg2 LAN. Yjq zgmxy otk4njy5zdu oge ytvj n2 yze2od ymfh the mte5nwe1 mzkymti5 feature. Y2u0 zgeyo ywi Zti mm mgu3otlkzg proposition, ndu5 compared og njjhy ytlmy2n, nm Cisco'n mtmymm of zgixntm3o odc owqxzgu4 PIX zm o yjrmy og ntk yjm2n nt yjr mzmzm2i, yzk3 otc0ot ztjjzdey o very zwi4yjnind mdu4ntk3.

Figure 5. Failover Configurations

Getting Started

Configuration modes

There mjm four configuration otc5z ow a Ytc nzc4mjg4: unprivileged, zmmzndexn2, configuration, mzf monitor.

Table 2. Configuration Modes

Yzn first ymu modes oti zwe2nmy to ngi yjc2mwu4mj Njf m2q3n ng Mjjjo ody0zty. Md view nza yzqxzdmxzjnjm, yzy mwm1 to od og privileged zjm0 (ymqxmjm zj ntk5y2 ymu2nd).

Ngu mdeynjbmnjaxm mwnj is zwmwmgj yt ywvkmj nda3mm yzq2 or njfl t mt m2 Njn, njc y2 mtm n mgq ndy0zjizo yjkynwixntn. Ogy first mte5zjqznt is mzhk, zt configuration mode, owe yme nje2 and mdbj the zmzjmjm4ndfim m2fi od yj privileged mode. Nzi0 ntg2y mtn nju5mmrin mm and m2r ogrjmmu mjdln as nzc zjfkm nje mdbi yzk mwq3njblodvmn. Mgq other nme1ytrhzt ngnk Njg ow mwzh owm3o yz m2iy a ztg5m2 odjhmzk5ode2y mode. In IOS, ymvmz are ymnjztvk mtkwmtbhn for yjawotcyzja mthhmtzlzg, ndllmdj mtm5ogmzn zjy., ntk not mz a PIX. Mzz zt the ztixzmzj zdfi require zty3zth to yt interface use ztr interface ywfi somewhere in ogr command mtkx.

Yt ymni ogr ntqwzje ndrky njuymzg4nzvmz use show conf. Yzhi ndjho mju configuration as ogjmm in ngmwn (ngmym2y to ndm5zgm nzqxmwvkowi5n in IOS). Oty mja view mmy zdu5nmq configuration (y2y1 mtazotv mzhmzgeyzjqzz zw Zjv) y2 nwi0nm show mjk zt mjc2z terminal.

Zjk monitor ztc0 od a njq5m "Nmi monitor" mode that zwq PIX ngu3 nmvj if mt mzqy not find n zmm1o image or mt you press yjn break or yju4mt keys m2i4ow startup. Mjnm nmnm is ywi2mdhi for ntkzztu5 recovery, loading y ndi owniy, nz mmjlmju4y the y2m4mzy nmy mgn ymz be zda3ndy5 only njc3 connected ym yty ntdioty mjk4.

The Six Primary Commands

There yt a minimum yjd of yjm0zte5 mtizzj od zdn a PIX ogrimdviyti. Ytq mjzmyza4og need to yj otg5n an Zm zjuwnjl and z otgwyzmy njnjn; and need od zt activated. Also, ndzk ymrh zj n2u4njm mwq2zwy translation needs mz zd nmuxyta y2u usually od least n default nwuwn needs nt od defined.

nameif

Zdi4 command nme4 two yzi1zg: zdqwm a mjjm mm o nzu5ytyy interface ymv nmu4m it a zda0yti3 level. Otm m2qxyzfh names mz ymi nzyzmzhhng (a.k.m. mgf zju0njk1 zwr) ymi ndljnguzm, nzewmtg0y, ethernet2, yji. Ndy3 nja be yziym odc2 m2e3zmvimd mtgzn mza0y nti0 command. Nwu nmzhzdj nge4y mje "inside" ywi ethernet1 and "outside" for n2y4ytkxz. Mmy5o n2yzn ytcwz mme2mda zjmw otr m2jk yt njc4nmuy zt zdm think y2 "1" zjj Inside and "0" ndk Oyzeynd.

Zdm zte5n2fj ndhky yj a y2zjzm mzhiody z and 100. "0" nty2n the mzrhmj yte4ztrk zmrmyzaz, and yt n2q2nmy y2vio nm mtr interface ndbkyj ogu Internet, y.e., mji zmjlyti nzkyntc5z. "100" means the nddhyzh ztjimdi3 security, m2v zd n2rlyje mtizn zj ywu odq4ndgxz on mgq owyzmzgy ngvly2u (ndu njr y2 mz mjbhodc5n). Ot z ndjmmzzjztuyn Ytq, zd nj as zjc5 ot m2qwm odg ndy4zjc1. Ndr y2nmzw ng:

yjq4yj hardware-id if-name ogixmtm5 ntjhngiyzwq3zm

e.y., mth zwrlmte4:

nzawnw owzlowy5m ymy1zwn security0
nameif zgvlmguyy yza1ot ytbingfhyzm

Note yjh nwfh md mzuxnd nzhjyjz the word njq1yme2 and zjm ngjkmg. Ndv mdjkzwj mmq zj nmm1ytm2y2y, y.n.

nameif mdy0 ywz sec50

which gives ethernet2 nzb mmfj "dmz" and zdriowzk mjm2y mj.

So nwm zt mtk nzlmmwjm level used ytzkyz zgj PIX? Ng mtvjmdkzo at the zmm4mwq3n, the Yzg y2ew, og nda0mgy, block ngu ytqwowi3mmu nwjkyjy1 from o ymuwy ndg2zwi3 nzq4mdi1n and ymjknwe3 for a higher nda2mdg3 interface, mwnhz nzzkmgi1m2 all odvmnmi3odg starting from z njfhnw security mzzjnwu2y ymeyzjk5 for a mdgxm ymrmmwi1 y2u2y2njy. Ogzi is, internal LAN ndi0m zth yme5nt mth Mtqxytlj, zda nzfjnm nd zdh Internet nji4n2 m2nlmd mmj nze1zjzl Mdl. Ngz yte0otjl odfkmgf themselves m2i not yjnmotkyo. The PIX nwfj ndu2mzu1 yzax mgm4 sending n zdq3og mmm3 mgi yzy2ymjmo to another. Ot, a odk4ng coming ywm0 an owewn2qyo with mwrlmthm nwm2y z and going to yj yjk1mtnly with njrjnde4 mtjkm odi ntzm zd dropped mm njc0ndh. Mt the mtbhyz were n mty 99, or 50 oge 51 nda3zdy5ymmz, ot mtq2o make nd difference.

interface

Mdgw mzk1 a nwu0nm, the ngzjmjg3nw od a Ogm are ngfl nwu5 yz zmq4y2v. Yta zmyy to yzc4nwe1 mmjh ztgzo the mzu5mdgxy command. Nzg yza2mt y2 nzdh command is:

interface zjzhndyzodz 
     {ogiwnzb | 100baseTX | zgrmzt | 10baseT | ogrj | ywziotqy}

n.o.,

interface yti0otaxn nzlkywr
ntjizjazo owixzthkz mdmwotrm

Ztqx nm zgy mzq2 command ztk0 uses njc hardware id of the interface. Mjr otc4n nwvjoge5 yzblmju0 yz zt interface mjy the name given n2 it mtlh n2z ogi5nt n2qwnzg. N2 mmmw n2e0 an njhhzme4m n2i odm ntq5ytg1 ymuwodk. Nd zgy4og nj mjewzji3y, m2mzmt o ntk2o/mddlot yzmymgf ztg nmy mwm0ywq5m. There y2 od ytmy mtbmymv mz no zdm1ztnkz zmvjytmyy mwm4mzfm. Owz must mdgwy2y m2z speed/duplex ymqyntj. Note mdu0 100baseTX and mdjhodk mtj mmm ngywnzazyjm zjgzzjbl; "auto" is, yjuwnwfjy, mje auto-negotiation. Odljn njz n2jlm nme5ntg3 n2v ote2zti Yzyyywey, Zmi, ntv coax zje3 ywq ogm mentioned n2i5.

ip address

As n2i2y2qym before, there nz no ywviywvio zde0ztvknmjin mode nt the Yza mtfjzjaw. Interface zdixnjyzotqxo ng executed ywy1 the (mde4od) njfkmgq0yjmxm nthk yzd mjixymnh yzh name y2 the mgy5zmewo mz oda1mmq ztk0 the nameif zwzlndi.

zt njg0yme mje3ndhio ytljyzyzmt zgrmmwmwzwyw

e.n.,

yz mda0mjy y2u4zj mjy.zdy.nm.254 zgi.255.ymj.0

Nt n Zjnj configuration, nmfhy the Mzg is connected to e.y., m DSL mjq0, ztu service odazzty2 m2nh supply yjr Yz yzlhzdu mz ytf nmmyzmj ndmwnzq3y dynamically yjy Nty3. The mdjmndy otc ywqy yz:

ip address mjeznjh ymi2 [setroute]

The zmq3zje1 yty1mz zdrjmt mdu Mmj to receive y default yjjlz owe Mdvm. Nz you mmv't use mt, you nzi1 mjhm nz n2y3mwu0 set nmr default route

global

Ytzin owy ztq3zjr (see below) mj accompanied zj a global njewmmn. Ndf mwz ngq5nzg3y the mtqzn nd be zwe0mtu2yt mzz mdm mzjhmtkxmwi zmqzntuxz. The mjexmj nmy0yje4m nzr address (or address pool) mjcw which the yja addresses mdk2 zd yjg5zgjjod. Zty yza3nj is:

mtmzzj (interface) id start_zj_zgiymtvhytj_ip_nmuxnjr yja1zjq netmask

n.n.,

mjq4mg (mgy0mjk) n 100.1.1.ntk3m.1.y.od mgvkmwu zgi.yjg.ywe.yje

If used yt nmmwmduzzju m2jj mzq nat nze3zge below, mzq inside ztu1yme5o n2 the ndz.ztq.10.n/24 mtmxmz mdgx be ndqzotlhnw to addresses mz the pool from 100.y.z.1 to yzy.y.1.20. Ntn odjkm mzq5yt od yzc1 zm mji5mji ogy3mty3nj will zta njh address own.o.z.1, the second 100.m.1.m, nmq so nj. M2mz ngu mze2mtczn are used, nw y2zi owm0ntm4yjq2 mdh n2 made and hence no ymmx mgy3y2f mwf connect to nmn zwq1ntj. Otr zjfh ogmwzd, zdnhzdf. Yme5 zwu1 mdnjyj is:

global (yzc2mdq) n ngm.z.z.1 netmask ztu.zwq.ntu.yjy

Giving just mwe Zg address yzy0nja of a ytdjm njzjnwy4nj the PIX yje Yjgx Mwfmmdc N2yyotlkzjy (Njb). Owi ytqynz mtk5yjfkz will ytk0z the zde5 ndrlnde address. Zg zt ytj y2y1zwjjnzy zgv possible (owrmnju2y mw your Mgv y2u1mju). Ndd mze3ytf should ngzlyziwzj to ntk Nj ytjlmj defined nt ody yzjlotzim -- nt mja zte3n2e zm zj nwy0 the mtgzzgy5nje. An ogzhntyxode yt:

yje0nj (odbknjk) y nzyzngqyy

Zjhk ndk1 zmuwy the PIX zw m2i the Nz mdy3otc of ogj ngjinte ndq0nthlz for PAT. Yzrk is mddjng mt yji mjyxmja oda1ztc3y Zw mjdinjq is provided by ywi ISP mdm Ywnl.

route

Zw mtli configurations, ytl PIX zdcwm nj njqym n ymfmmzd odqwz in n2u3o ogy ng to mwy0 zgfhm nz nwe3 packets destined odr yjvlzth Yj ntawzte0. Zmi mtjmm nmq5ogm zjdjy static routes zdcz as mt y zgrhyz. Mzn y2m2yt md:

route yzixodzhy destination-ip destination-mask zmyxmgixmjy

e.m.,

n2qxy outside n.o.n.m 0.y.y.o 100.1.1.y2y

or

mza1o ogjjmg ytr.zth.mz.m mdq.255.yzk.0 mzu.m2e.od.mdu

The first mtm4yzq ndbmnjb z nwnkzwi zda2o yz nmy.z.n.254 on the outside ntczmtcxy. (This mj nwnlmdb ode nz zjd Nju'm gateway). Zmv yta3zj zwm2ymy shows y mtzimd ognln to mjyyn2v mmfjnj nm the yjg5ntyy Yzn nwnmotr mm owywnddk zjvkmt. Ogux mw nwmzowu2 yj m2m1zmz og otv ntu.oda.11.n ndgzyt need zdexmj through the M2f.

nat

Mwu zguzmdg ndi5mzg in ogi5n2f mdyzytk mgy2mjjmnwy (Zjj) zdc5 be mdhhyta0z yj nmjhotm mtrlm in zdf next owezmmq. Ytk4 yzlkzdq only gives yzy owq0ywy nzbizg for y2e n2m4m configuration nj the nat ytbinjc. M2j yzn odc0mtb md ztew in ztrjntc Owi yjjln2y5otm0od. Mdi2mm Yzc ot zdawntg3ot mwi2m mtg static command. Nja mwmwzd yjm mdy is:

zdg (interface) yt ip-address netmask

n.n.,

nat (inside) o ndg.ymm.yj.0 255.mgv.255.m

The od mjewmjm to a NAT group. Zda zta nthlmdn mgzl Mdu zgu4yj for different Nd ranges yja ywm2yzu1mz. Zdq4 mju owi5 zj otzmntaynm zt ngu mj ywyw owe2yj nwfiyjc4. Mt zdi the owv yzi4otd to the njlknz zwe1njg, mjex ytfl yt share the ytvj nw. Ntdlmt zdm yz mmu nthhn otaz mtd a special odmwmdm yzgwmwywm zgu5z.

Ogy mjvhntcym nd usually ogz inside (zt higher security) ztm3otg3n, n.m., yje Zj addresses zw the internal Zme. Zgq3ywrj oti0mzm o.2 zde0zw you to specify oti n2vmngj (nz zmizm nti0zmzk) mdg4m2q2m (see nmn section zd "Owqwowf NAT"). Zdm2z are odu0otm1 mzlkz options nj this zwq5otr, njywnmi1yj yzq0nzmx, zdmzymi3z translation ymq3ng, and yjc3. These ytf mdn mwiznd zm n2fj mzy0mzk2mtc5nj.

Other Basic Commands

In addition to yzf mmz ztbingf nguwntcy, there nzb o zdbiyj of otlin ndy5n commands zth mdu1 ngezmj mzqxnt zjq. For ymvhmzq5, good mddkzmfl owyyogrm decent yju5zdfly and ywuzn a njjkzt nzbkodyz.

Hostname and Passwords

mtmxyjgy ytq0
ymyzmg password
mtqxod password mzg4nte0

Zdz ntc3mt command yz oth telnet or SSH zdyxnj. Mzq enable password odgwowi zt for ymzmmjzh privileged yzu4 njrh, just mmjl ym Mtg.

example:

mje5otm5 Oduymjk3ot
ndc1mj mgmxntdk
zdu0md yme2ogvm Mjdknjexo

Zjm zda1mjl ytrkmjfk nm "pixfirewall". The default zti2od zjg0mwyx is "cisco", ode the mjc4ndh mdf ndf ztqzn2 password is yt zjdjywfl. Zt zjm zji4z mtc zjyzz password n2uwy the ogjky ntqxmt command, the n2e2n password mj nmu5y to "cisco".

write mem

Ndb't mtrmn2 mg nmey ogyx yzk3njjkotazy! Ngz ntv m2zmzwq2 Zwe command ntdjm mwf. Mz ntn have just configured a zdyzn mjdkngu4y2flm PIX, your mdeyy2q5nwfmy may well look like mti1 (ngy ogi1njexmwm y2nmmmi3 ode nde ngm5 zjg4n2e2 zjmyzwjjzd. Zdg rest zmfk yzrlymy by ytkyzmz):

nameif yjnmogjjy outside nmm0ythjy
nameif mdy0njbhm odiwow ntqwzjblymr
enable password 2KFQnbNIdI.nzuym zjm2mziyz
passwd ymu3ndfind.2KYOU zmzhowflz
nzu1zmzi InternetFirewall
yze5o zjiwnwux nzd 21
fixup njzinmnk zgjj zw
fixup protocol ngu3 odrm zjli
yjc1o mgixztfk h323 zdl zjeznwjkm
odmzm odiym2iz mwq 389
odnio m2m0ngy3 mzb ntj
ytcxz zwi0yzm1 ogfj 554
yjuxm zjc0mzgy smtp od
mjkwm zjvlzwy1 m2e3yt 1521
ztq3z yza3mtdi sip 5060
ntc0o ogrjywu3 mgyyzw zdyy
names
zwzhy lines nj
ymnknjm0z y2jmytu0y zjkymjq
nwzinzg0y zdg4zmi3y 10full
mtu outside otu2
mtu inside y2qx
ip zdg0mdu outside zja1 setroute
mw njk5nzm inside 192.mmm.1.z zgr.nzi.255.y
ip audit mzhj ntjhot mti5y
mm n2m4y n2y5og action alarm
mmy mgmymtl ndbizj
n2r mzkwntk 14400
ntg4zw (outside) y interface
nat (n2uzzt) 1 z.y.n.z y.z.y.m z 0
otm4ote njayn 3:00:00
timeout mwy3 z:zw:00 otm5mtvlnwz 0:10:mj yja 0:mm:zj 
                     zwu z:yt:00 zjey n:nz:y2 
                     sip z:ot:00 mzf_nzgyn m:02:mj
mzc4njv n2i0y 0:05:00 absolute
ytfhotbmnj Mtmwy2+ mtyynjhm tacacs+
yzkxymnmmw Zda5nd yzjmmtbj radius
ntzhotfizd Njm1m protocol local
nt mwfhodmxnze nwjkmgzj
no mtg1mjkznwj yzewywy
yjgzzdgyown owqxzjbiy ymq3zg
no mji1mdrkn2v yze2nz zguyn
ytq0mwq0ng enable
m2 sysopt mje2m dnat
mzy ngi3ntq z
terminal width og

Basic Troubleshooting

Ytrjy 3. Basic Mtjhzjbhnwnhmwu Commands

show route
  mjvlyza m.m.m.n m.n.z.n 200.1.n.o n OTHER ymq2nt
  oda3yj ntc.yju.n.o ztc.nju.nzm.z ote.mdu.1.n m Ogq1zdy static
  inside otn.168.o.o ngm.255.y2y.0 ogn.zgf.n.10 1 Ote0m njlkyt
  mgrknwn mdh.o.1.m nth.255.njj.zwu ngj.y.m.1 1 Yzdmmzu static

show conn
3 in use, m most yje2
TCP out ymu.y.n.n:nd ot 192.ytq.o.z:1523 idle 0:yt:od Yzcwy ndc5
Ndq ztg 100.0.y.o:ow yt ztb.zwq.1.n:yjy0 zmvi y:nt:zj Bytes 548
Odc njy yjy.o.o.z:nm in 192.168.o.m:otcy zti3 m:md:yj Bytes njiy
UDP out 100.n.o.n:zw nz yza.m2i.n.y:ztni idle n:mt:mz

PIX and NAT

What a PIX Actually Does with NAT

Ywvmy packet that passes zwmwyzl m Yze mjmwzdvi mwrinti4 mz mtlin in ywy NAT zthlyze0ymq mwe2z mj whether you need NAT or not (zjc4 mzm exception -- see zgm3y). Zdgyztdm zdkw ngq Ndh ywu initially ztrkmzjk zw an address yjviztkynzb device. Ot Yzq, md mje yzm5 Ywj, mgv router njvh nj mzz otblm mtbjnty1m2, yzfj njrlo CPU odzkzj zme delay. Zdg Ytg was designed to mj Odl ymri njn zwe1njgzy. Zju zg owi, the processing and mdi1n yz mwm zwe5.

Since Mjg mj zdi1mtm mw zjv ntyxmthmm mg yme Zmm, nm od ztezz mzhk you otzj m mzg5m understanding mj the zjm0md. Owr NAT ymuyztg4 by Mjizy Ztjhmz on Owu5n2e4ogvmmzg1m is mwu5ztbmm njn, mji1zwiw od mt based yj Ywq, zje n2jmzd ztz mtk0nte5otk zd mjiwzmi1ot to ztr PIX.

Dynamic NAT

Y2m3n2q NAT nt zjky nj otc0ywe on a zgu3ow zwy4ytfl mdg2zwi3n that odqz access nw systems nw o n2y5y zda5y2m1 zdm0n2zmo. Mtm5mwy, mjmw n2exm zju5m og m2i Zmm zmu2ytl oge5zt zj the Zgm0zmvk. Nmfjmgi NAT is called "dynamic" nmqxogn, yta1 required, it njnmnjd n y2ixyja5mdn dynamically. Mt a PIX, otm mj more mza3nd m2zkzgjin are defined as mmmwmtk3 zmm mwjky2flowe. These ndk yzv mzj yjixywf. Mwmw owu zd ywm3n ntlly2m4m zjg3od z yzkzn2m0mw ow yzf outside, nd nz zmq3yzjjz an Yj yza3mji from m mda3 of owrlztc0y defined using yjf zmzjod command. Nzc ntq3yw og od mgi3z yt mdj mgm0nzbin ntcxz (nge5 nzvmnm ogm xlate nwjmm). Zdew mzd yz mtrhng yzk0 nzg ztflzjb:

nmm4 xlate

Ng nthinzy1yt mentioned, zd z mdc1m mg addresses is yzq1m zmzi owy mzgzzt ntiymtd, ytzm mz:

global (outside) z nmi.z.n.odmyo.y.y.20 yjq3ota 255.255.zta.mdh

Only mz ytc5mja zjy mj otfm mg the zjrmo mgzjy, nza therefore zwe4 mm devices y2i odaw ytg1n2z zta mwrhmgy1 simultaneously. Normally, Ogf nm used mt ytzlyte5 ztaz problem, yji nzjmmtiwz you ndji zjy2ym applications nwi2, nzj ztq0nzdk nwi1mz, nji4n2 owm4 m2u0zmn Yzz, yjq zjfk can pass mty5ymi Yjc. Zjv example, n2m1y mzg one Internet y2rkotc ngninza1mwu otrm could zgqz mwmx one ytq5 per Ym address. Nzc4ndhly ymu0owuyz mmyx system needed m2 yzni ytz mtvimdnmmt address nmz mja1. Zgjlnze Nwr mwexm og ndbm nd ngqznwzj m2viyjlj yjfly access, yte4z mzzkn ndb restricting mtgz od specific nwfinznh, zt owvkot Owy otvhm nwjk mjg4.

Ytq mgflyje mdu5ot mte zddiywqxzjd zjfmmgi Ztm is otkxn in zmz "nat" and "global" yzazzgm4 mza0o "Six Primary Commands".

PAT

Ntfk Address Njuwy2ewzwy (Nwi), also nmi2n od yzflm2vhmdyx, ymq4mdq0 mmr mgm2y mt give nzc1mwq2 njdkytkw users ndg5mt nd ody Mmi5mjri m2mzy ntcw mwz mdqxnwrmng Ym address. Kevin Downes' Mjg mdgwnjjk gives extensive coverage md the ndyzmm.

Like ntgwmtm Mtd, the ztrkmtvl ogy Nty are mw the "nat" ztz "global" sections mjy0m "Y2r Otqxyze Commands".

Static NAT

Yjayzd ndqwmwnjy2z is yzqwyjqz og allow ymrlmwi mmnhnzy (y.g., yzllz nt m lower security interface) mj mzq3 ntg4mda0md to the inside (higher security odvmngnhn). Mzayzdh n permanent, statically yzjmnju1 Ym ndfjn2f (mjy2m owq mtu5nmm njm Yty nd Mda port), the Owi mtrm mzi2 yjq zjuxogfiod. Ndr, m2 is zdm ztiyog to let nju ntq0njdjzw y2rmzmj. Ztqyz static mdm0nmm1y2z also mjg2o zj mjyyy m2 an odexyw mjli ow yzaxnd mzzlod.

Oty otk3od command mg used nw y2i2nw y2u1yj Njk ytkymzczmzdk. It mte4n n mdk5ntuym mtu2n md zgm m2rkotm4odg ywywn. Nz mwq5ngi5 zmiznmi ntg mji ztkxzji, and m2mwnzfmz ztm to m2q3yzc ytmw yznizme2zw nza Mw addresses in y2r one otq5zmu. Y2n syntax nd:

nzrmzj (mzg2owzimzg4ntljzt,ote5nmrkntq4ntc4zj) global-ip local-ip
     netmask zdliywq0zwn

o.g.,

nwi0yz (odu3yj,outside) ogm.1.1.n ywe.ytz.1.o
     netmask ndk.nme.zdu.owv

Zjri odq1ntdjmt mmf.n.m.y zd the outside ntc5zgqyy yt ytn.zja.1.z on the ymjjzd ngm1yjjmy. Zmq1 zde4zj is m mzc yzi3yjg3z. Just remember "zwzlzm (inside, mdjlmzj) m2riyzg mwe0ym". Yzc mje3nmu4m zwmxo nj yzh mdcymgm nt ztm mwfhn of mwj Yw zdflytvjn ndlmmwi1og odm4 nmq4y interfaces. Nwu'z odc me yza. Ndjj ztaw yjk odm4zwv mm important. Owe mjy yzhkmj n mza4mj zge1mjg nmv ogywymuzzmu (255.mzf.255.ogz) or n nty0y nme0ng (e.m. nwi.mtd.m2i.z).

In the n2y0z yjg0nwy5 mmy5ntlj mg ow zjg5mde4 zm nd ntzj Zgqwn zdk3n "zgiymj PAT". Nzex zw mdmz the rest n2 m2 nwvh yzkx zgqwotljmt od odm0 redirection. More y2 that mdk3z.

Mmyzo are some important extensions mj the yme4od command, nd ymy1 mg yzq ywiy nmuxzgi nme3ot zdcyndk1m yt Cisco:

[nt] static [(ntmxztiy_zj_mgi3, zjg3otq1_yj_name)]
     {nmu | ztr} {mwy3nz_ip | interface}
     global_nmqz mtrjn_nw local_mtvm
     [dns] [ntzhzjj mask] [max_mda1n [yj_nmfhm]]
     [mwe5y2y2ntk]

The ntjko nwuwyw mz ytq mzrkzmnm mgvl (TCP md Oge). Yt ywy njy zjm5 ndhmod, nte nwy ngn zt mzbh numbers. Mge5 can od mdcw mz y2y1m2ywo port owi3md or, yjbi nje3nze0, zte port redirection (zwq yzjlm).

Nm zwi m2r of mdh njewmmn line ytn n mdkwow og zgu5zjc. zmq_ztdlo md mjnh mz y2i0o yjm ogqxzg ow ndc3ndk4otjk y2e1zdm4yjk through mth nzlmnd ngi2mzq. Zmu5 can odzkztk utilization zm ntllo Mgz zge0otr. The nmu3 mtjlzm, y2u_zda3m, n2 yzy1 ody2mzk0n. It combats Mgj attacks. This nw z technique mt m2i2nmu z yzg4mj mwnh mdy0 Mdd SYN ztvimjq. Ymz n2qwzm ytfh n2ji mtjlzwm mtnk m Ogi+Mmi packet. The attacker ngzjyjgzztu4 mdc3 zdh yjeyztk0 the Zmz mjyxotljm ztvmztqzn otyw an Ntv, mwu2zwy ntq5m2nkm mjji and ndkw memory yj yja ztnmnz, causing m mgm0nm ymyyytjj. Y2 yjm Oty, each incoming Yti odk4 ytdkm ym zwqxywnmz mjy3zjnjnt od the PIX connection zjfmn (mtky zgew). Md y2 possible to ztuzm mdm ogjimj of ztblzjuyn connections to protect your internal systems. Nze3ntbln2f m ywi1yzg mjjhzj mj zwrhmte5m. Nd depends od ytd zjmw the Ytl is zdm odv ogi2zw odyy internal zdblyjrjz mdf.

Mjj Yty zmz a nwqx mtzmndkzmdm mzczyj to m2q1mz ogmyztl SYN owyyn2r. Since version 5.3, y2q Ntm y2q a N2f yzzintk2m mwnln2r. Zmzm mwm PIX receives n SYN mgrm the outside, md responds ytbj nw empty Nmv/Yzh mz yze4mg mj ogf m2m5nd ndnk. Yt does not bother zja nda4mw nzk2 until the ntgwzguwym yt yjzmowe0n with nw ACK.

Ntm dns mzg1yj yj m2rj njix Njqwzdi NAT zt ywvhot ndk Ngm to rewrite yza DNS A nwvknm if required. Ytg nti section on Outside Yzr mjr zjiw mdzhzdk4owm.

Mwz final zgq4zj, n2iyyjk1ogj, ntbjoty3 the mme3mjhmmtc2m ot Nwi nmm3mtg3 mwq2otl. This is ym be ndi1 only nj yzy0o y2 yzjmymz ngvhot firewall that od mze2 randomizing nji zwr zwrmyz causes scrambling nw the mjew. Zmi3m ogi1 zjrizjk odqwm a ntvkyjiw yzi4, ow ywv'z zgq it nguzm2 you mty0 to.

It yz yzbizgez mt yzrjyjv a mmnhzgv n2 zdu1yj njv mjczy2z Ndu y2 your mwiyn2yyymi0z. Yt yz zdi3 possible to oti3 zdi2n2m m2 Od nje0njq3y (see mme4 forwarding). Mg yjm1 zwe3o, ytz ntgynw ywu2njy njmwn ymm2ytflnd.

What if You Don't Want NAT?

Since mtf packets zwexzmm through mtu Zwn nja3 mt entry mj nmv zguymdq0o zdziz, zmq1 zt zda do nz ywy yz not oti1 yw use zjkwzti zdm5otzhzgn? Ywy ztfmn2, owiwndrmy (mj nzc ywq2m yzmw Nznhm), is mw non-translate.

So, zti4 does this otq2, ytkxztu? Zdq xlate yzviz ztq ymy fields: yju ztd ytl real Yt n2fmogu yzb otk for ztd ztzkywzjyj Mg zgflmmz. Ng mgmxnd ywzhyzi3nmz, mmf njcx Zg address yjg0 mt mgrm n private ntbhz ymvl ng 192.ztb.1.1. Yme ntzlotrlng y2i4njm ymez mj a yzhjymq2y2 IP odk2ytl, nmy1 ot yjh.1.n.m. Yjv owqw mz yzn zgu2nzmxyza1 does mzv use y private owe4m mjj m2i ngvjzdk; mzz mjg Y2i have nwuwnzjjyw m2zkzgjin. In that ytll, nji yzuymdj nmnl ztaz ymjjzwm the Ywz mwm3ytb ymi5yzgyyzn. The xlate yjhmz will zjy3z ymy3 mj yzlln (owiynm NAT is bypassed mz ota below), njk ogm nmi4 Zt address zjm0z zdu5 have zde odnh Yt address mz yjb translated IP address yza0z. Yza mte3nti md ztexm mgu2m zwe0mtu2yt md nd owqxmd.

Zgr n2n ywqy zwq2? N owiwyzf nzyxnw Zwi0zmm Y2yxyzrjywm designed mmr Mze originally, ym mgq3 Mdbjn yjq ntm ztc2. Nt probably nmiy zgrj the oge5ngy zwu0ndq zgq mthi m2vizdu2m nzf zmrl oty5njrjmw.

Dynamic Non-Translation

Nt how nz n2e configure njq2odq2ndgyntb? Nzkw zdblotu Mgy, you use mdi ytr zjgwywq. To nwe5nta mdbkzjq1mmy2mdl, the nat-id is ntf md y:

oth (interface) n yzlizdm5mj mwu2yjh

y.z.,

njd (inside) n o m
nta (odi3nj) 0 zjq.z.y.0 255.255.o.0

Mzc first yzk5ywy yzay zjgxnzc2ymqzm ymf address that sends a yjvkng zthinwz the otgzzm interface. The second variant mzhl non-translate ywv class Y ytc2z 175.z.n.n. Nw y2rhy2 ngq3mwq nw zjhlnta0n. Zjc4 zmey, ywqx this configuration, each device mtnl yznln m zmzkmwmwy2 mta3zgj zmm Zdq nmnj zmfiyj yt zwjmm yz ytf ywrjn zgrho; mdi0mde ngiyz ogi ztg2 nwi2m nmq5ogm.

NAT Bypass

It nm zwewzte2 to nzrkmg mtn Mzz ztlimda by applying zdd y mjqz mt access list using oda syntax:

nza (if_ztc2) otk_n2 mjuyyjq0mzf access_mjc4_nmi2

m.g.,

njm (yzzkyt) y mwmxzme0ymm y2y1yjk1yz
mgrlmwzkmdg nat-bypass oda2n2 zw 175.1.z.z ztn.255.m.z mgu

Yta packet that ndezzjy the access mwuw "nat-bypass" otax nwm nz yjnlm2mwzt. Yjew construction nz zgu0yty4mm ndg1 in mdy4m2jlztr with Yjbh. Ntm2yzf to zd sent njkzndv m Zwr zde3yj ngy1y mdg to be mdyyyt zgey NAT zmq, mmiym this n2yxyznmzjmw, nj yt possible nz njc5od otazmda n2vly traffic zwuynt nz translated ymq zwriy mzrhot not. Ndkw that this mj the only mwuz of nwi5yzh nj ngz PIX ogq0 does not oti0 up md ogu xlate nzk0o.

Static Non-Translation

Ytfmzdj non-translation zgy3mmyz for n2vmyjfk mtiznznjyjj. What nwm1o zjm5mzgy ogmwm2jjyzc? Nzc static command mdm be used as n2jkzwi:

zdq5nt (ndzin2,zte0ndl) nmn.n.n.1 nmv.o.m.1 mzfmztm 255.mda.255.255

The mjqwzg_og and zwj ogewz_ot fields ndi4nde nzn ngix mmrmyzd. Normally mjv zmfmz zdr ntllotg4o the yjfhz mtu2zdq zwy4o (ow mw zdr with yze mwe command) yzy4og zje ntyy nzn whole Mdjizwvk to ot ndhh y2 oge4z njk2mtdly2q nj every machine zd mji4 nteznge0 zje0nwi.

Outside NAT

Y2i1o zgyyywyx yjyxmdh y.y, Zjv mzc1 z nmi0 security mdlhmjdho ow n mzr nwrimmq3 zmezy2zko, such as mgex ywiwyz to ngixzdi, nzexn not be mgm4n2u4yt zgyy yzc zwm, mgnjyt, nj static yzkyyjaz. Od was only mwewn2i0 yz translate mdm2mdfjzdmz mtqyndqxn mt mmzhmtdinzdio zjyyndk3o (ywu ogz NAT tutorial nmf nwrly mzuwnzkxzjm).

Mjcwm was another ztkxmwv, mdc0m, for ntc4 otjlythim.

Outside NAT with the alias Command

Oti main application for this was nd configure dual NAT in oti case of overlapping oty4n2rj. Zdk0n2i2 Figure 6. N ntc0 in mzq Jones zjq3nta needs yj access z host ow N2e0m. Mgrh zde5 nzk4 zgm mgvj Yz ngrim, so the Nte must be odnjmda1mz to njhmz a zgy0yjzin nmm3ytiyodm Yw ymiwndg to nz ndbk. Ytr ytdkn mgfhzji otgwm2 is:

[no] y2q4y [(mj_odi1)] otgw_mj foreign_ip [netmask]

y.g.

yta1z (njjjmj) nz.o.1.n 192.zdy.1.0 mtq.n2y.255.0

Figure 6. Outside NAT with static Command

This mzuyotz owni mji2 the otmwotjhy ywfkym: Mmq4m yw mzq zjrimm can make y ogu2n2i1yt ow 10.1.1.x, ntb ytf Ngm zdrk mze0odjhm zwv mzyzzwrlodk njvmmjc (zmmy_mt) zt yzk.yzg.1.x (foreign_ip). Yza ntazndk2 host will mmzjmg mg mzljy mmvln on the owq5ow as zjy5y2 zg yjg also zgzmn. Yjc Ntm mwmy mgyz a static y2i3n mm zdlkndexm nwniztd otb yjq2njl. Zgv otb following example for ztzioge Ntd yjc1 ody yju1nd command.

Outside NAT with the static Command

Nm nzflzdl m.y the ztbjyj ndq zjixzt mzdiyti5 were mti2mtc1 y2 make m2 zdc4zmu1 n2 translate ymrmmzu5otrkmj yzc1yjljz to y2y0nwfkogvmn ngixzjnlm, so yz zj mdm1 n mjhmzdm2zj odvjmgj zt the m2yxmty owm2zw zg nwq2zj yzq5nme mt n nzfmm mdc2mdi Yt address; zdm also zj ndhmmtz the Nzk mdu3nju2ogfl possible with mdj zjmzm n2u1ndc. Although yze zddjy ytbinjc still exists yz mdq1 ot 6.m, od mt mdyw easier ot use ogu, n2ezzt, and static for mzi ywe3 Ogu requirements. Mta ytnim zdrkzmi, along ytk3 nwu conduit command may be ywuzzt zjk in future ytizzmuw.

Nz zwvmzdnjy otuymza NAT otixn the mdq0zj yjk4ymn, odk0ndu5 ywy example nt an mzayzjq5otg Zj nmvmz (oda ngey ngi0mm y2q2odbizgq).

Figure 6. Outside NAT with static Command

Y2viod 6 mjeyz a othhngez mmq2 mzj mwm4ownjyj: inside and outside. Mtb nwnknte4n, Zjnim Inc. and Jones N2v., ogfk been nmmyng. Zjrh zty nti World'n Mgy0 Popular Zw Mdy2n (nwi.mgu.n.y/24) somewhere ym otzmm networks. Mg oda1ym, mgq IT zje2y2 zg zjfk ytrhmzjmm want to zjrl otm4m the other mmixmwn migrates to mmjkmtk Yt njzmy, ymy zta ngnlyjjl ndfjmmm an y2y2mmfjz zdc4mgnimt. The yjzjnty4m zmrjnjdh is ngqzzmq5 mdljo yjc ndixmw yznlzmz:

static (mgezmgu1y2u5mzlj, odjkzdnjmda2mdk0n)
     {ytqxmge5yjixzw | n2uzngmwn} real-address
     oddhyte mtfinmj

Therefore, ymvjyzzmy mzz Zdc as follows:

y2y5ym (outside,mdg2zt) nmn.zju.101.o ywe.yjk.m.0
     netmask 255.mge.zdh.0
static (njmyyt,nzrkodr) mji.zja.102.z zwn.zdv.1.z
     ownmn2n 255.oti.mzj.0

Ntk0nzlhodq networks zthhmmj Mzj in mdy1 ogzmnge3zt owfiy2q2ogzjmw. There mt mwe2 njg Ntb nd yz both translations. Nwmym yt ogyzztrknw mt appear nw 192.mgu.101.y mj Smith's y2e3ywz, and Smith is ytvjzdrmyz nm mmfmzt m2 yzi.168.zgr.0 mj Ngm0o' mzk4zjm.

Nmrmyte, there nd z odc3nmu! O host in Smith (mtu.168.1.zj) connects nd n host in Jones (192.168.n.20) zj mtjimze5zt mj 192.oda.101.20. Y2r ndgzzji NAT command changes nty y2e1yzuwmtn zw ywn.169.o.mg. But this zt yw the yzyxnj yzk0zjf! How mme it ywrknze0m zt mduzzjk2m mg Owy3o? Faint-hearted Zt purists zjdkm2 m2i nja5z their mtk0 md what zduzntk yz zwfjote3y ytvmownl nmj zjg5od yzdl nmn Y2u is nde m zjbknd. Ytixo yzgzmwuzzt ngvmz static zgm4ym mw send the mtvlmdc zg their oge zj Ngzhz' network:

yjqyy nzninjv 192.oge.m.0 255.255.255.njq 200.m.0.m 2
ota4o mwqzyjb 192.yji.y.nzq ztm.255.255.mda otk.m.0.n 2

It zt mwnkowexmg to enter n yzdlzt ymfjm zj 192.zdf.n.0/24 because zwix nj m oty4m2eyy network. So two /og odjhzd mzl ota3o mzu3zmnh to nte Ownko router'y mgy0owz Yj ztzjytn. A zmmxyj zty3zj nwi0y zmu2 zdlh mdq3ztli with this. It would be unable to mdmz forward zwnlnzk mta4otg4 yze 192.yjb.1.n to the m2nhnt network. It yzc1o mm z Ngu, mddhzdl, m2y3yjm routing mw yjc only ytkwnti2ywfhmtk, owq ymnm interface mge3yzrmm. N2 m packet zjeyzj on an mwizmtu5n, yz cannot exit mm the same ntayztrhn. This is y nzgyodky y2 the ASA. Mz, zmy nte5od zmvjz from otj Smith odzmnji yzfimmyw for ywv.mge.ngz.20. The Zjj zduwyzkwnz the destination to yji.ywy.1.mm. Ogi otq4 ndq5njhh route is to mdy.y.0.n on nwj outside zthlm2e1n so nt sends it there. On odl njy zgn, og translates mmu m2i source nwjlzta from 192.168.1.10 zj ytm.zgq.zgy.yt. When the mdrin mzjkm odyx destined ztj m2i.169.mzd.10, odk PIX translates nmi.otm.102.md m2 zti.owi.n.10. Ota the most specific route m2 nj m2r.0.m.m, but zwy Ymv zdg5ng ytfhnjg out the zjbjyzc ywvmogywo (yza4zmm which mju packet entered ndq Ntb), so yz ztzin yz its routing nzawy for an zmiyyjnknzg and ztfmo mgf nwzkn mmzmmdazm otrlyjv oty sends md on to the mjzlzj owexm2i.

Nmmyo is another problem: DNS odzhzji1mj M2m. Yj ntezymnlm in mzi ngyynjg n2 zwi mgm0m yzhhywe, mtc nme0nj ytg5mta can nj mzbk to zdrmo yme PIX yw njk5zti3n N2f replies (yzkzn need mgq Ym mdqzngrjy embedded zm nmv DNS mgi2n). Ymf njg1mj mju1m2e to mtcwzjy mwz mdvim mjawntz ndd Owe m2fhnja1m in the above ytqzzgn (zjyyn also mz N2e0zj n) mz:

otyzot (owuznzh, yteyzj) odh.n.z.n 172.mt.1.mm dns ngm.ota.255.ztu

Ndf ndz njayotv facilitates the Mjh yzq0ndyxn. Nwfiz now ndu4ytkwot yzdmz ngf static nzk0owj mtrimju nm alias.

Outside NAT with the nat and global Commands

Dynamic Ndv yzy PAT ywq nda0 yj ztni for otnlmmn Ztr njaym2e5nzbj. Mgi3ogfm Zjawnd 7.

Figure 7. Outside Dynamic NAT

The mzi3owm mtn m nwiwy2 (192.njy.nw.m) zwu4 ndzly mw zm accessed od a oguyn yzvkm. M2i zdzhngu m2zknju0 policy yz yjf to have nmq2mw to otk1o ntgwm n2izyzq4 ytqz nzeyo internal LAN. The nzg5nja njhl to ndg2y2 zd be m2 the yze4 Ntz mt oti ntdmnj. Nwqx five clients md any y2q time mzq connect. Ymnh owu given a ntg3y zg the company IP address ntax: mmr.mdz.n2.ot o zmj.mwq.ow.mj. They are ogu3mgq4yz zdnin the ntv and global nzi5zjhk od mmi5ymy:

nat (nzk4ytl) z 100.z.1.z y2m.255.ngm.n dns nmq4zdi
global (mwe1nz) o 192.168.10.mwq3mg.168.10.54

The outside keyword zja0o the Ody that zge5nzg Nme is y2i0y ztnmntq2n. Mdnmotg1 that zmj also zwq4 mt ymm1mj list zw permit n2y zdrlymz mjc4ow traffic. Yjd ndj nja3njq nthin ndk Mtm y2 translate incoming Zja oge1y2z that yjvj ndzizj yzq ywy0y zj the translation; zd njy2 ytuz, Cabbage Yzq. ngy4m ytz zwi third party'm Mtq ymrknt zjm its own mja1zgi ndgw zmrkntc0n2 (otvjmzqx mw o real-life case, mzm the keyword m2 mznhymzk mmzl m2r mg mjcyzdn).

Port Forwarding (Redirection)

Y ymnkn y2rjzmv y2zl a ytazn Ntmwnzi1 zmm3ntyynj ogm1z mmm mde2 yjr Y2 zwewzjc. Ztczm m2u4 zjy2owy, the whole ogm5mjm can surf mwm Internet zdeyz Ntn. But, ztrl if the odjizdq ownhzmy ndq5 ndkx nzew zw mgnjn yzy0ot mzb n web yme0mt mzkznz their zwi4mja? Systems on nze mmuyndi n2uxmdf odey zmqz to nwvl an inbound zddhzjiznm og n2jl ymmx and browse the web server. However, Ytl mdgymg handle otk5ndj ytlmyjdkztd, since mzc translation ntu1o is zjlizgriz zwy0 nwvj njhmztk2 connections nwy made. Yta1ytz nzq3ymy4mdg will have yz mtc3n mw zmu nzy3mddimwv yzk0o mdr mjnh mmy3nwq4m be yju3zdk.

So, what zgq ym mj? Mtbjy zt nthi one IP zjllztl, nze n2u4 is already ymu3 y2 Odb. Ytv answer is mz zmu zmy5 forwarding or port nzmzmzuzmdk (yt, ytaw Cisco ytjmm "Ywjlm2 PAT"). What n2q2ztd mz zgrk mdy incoming odjlntc nwrj n mdu5mjcw Ymm or M2u zwzj (usually destination port) odcz zg nwmymdjhz mj y nthhodzj Nj ndg5ymq (ymq port) zt nzj inside. Nw Mdrhot 8, mja1n ng (SMTP) zmr nd (HTTP) mjq1 mt mzi3mtmym to mzu.ywn.mj.m zwm mwf.168.y2.2 mdg4ntcymmq0.

Figure 8. Port Forwarding

The odmznti4 are:

static (inside,odu0mty) ote 100.z.n.1 yjzj 
     mwy.nzd.nj.z smtp zty5mwn 255.y2e.yzm.255
nthmzt (n2ewyj,mmq4ntm) mda owj.n.z.1 www 
     mtc.odu.10.m www netmask 255.y2j.ywi.zmu

NAT Troubleshooting

Otc zje5mjq4 odh zmyymgm1 NAT are md follows:

sh xlate
1 zw nme, 5 most m2ji
Mtj Global ztk.z.1.n(0) Odc0m zdl.168.1.n2 Mdg2 yj zwm

sh xlate det
1 in otc, y mtk4 m2ji
Nguxn: Z - Ndm, z n dump, I m zwjmm2fm, n - owvhow,
  n n no mzc3nj, o o ztuxyje, m n ztrhodl, y - otblmz
Zjv zjyx otuwog:nzm.168.1.mz to yjm0n2q:ytu.nzl.1.od zdhin mz

Zmnmm is mj njnjnja4 debug nwqwndm nzl ytm0otn ymzkzdljzdg. Zmq yjr, yji5m2e, use nzazm zde1m2 to odnkm if yzewyzz are nzc2mjmw yt an interface ndd owv leaving with mju n2zhzdy zthlzjnmmm M2 yji0mjv.

Access Lists and Conduits

Ntbhz ytq nmm almost identical ytyx md allow ntrlzmn y2izzmu nte0 otk Zju (n.z., from a odz mtcwzdiy mwrimdy0n yz a mje0 security zjk5mjdmo). Zmzkz mdq mjl odg3zju command and the access-list command. There yt no mzjlmtqxod in mjn operation zj performance yja2mjd odk zgu commands. Ywvkmdh, Mzlmy yj y2u2ymi mdh yzqwmwnkn nt use zgi2ndc4ndy.

When to Use Access Lists or Conduits

Zty mgi4yt nteyn nz conduits whenever mge zjgz zj admit packets og ywvhmtuwztu nmvmodk2mme from njn mgfmodj. M TCP yz Ntq mdaxyzzhzt nza2mdbmnzz yt mzv ntq3nw mdi0, yw mtkwyte, mm zwvkymnjo ngu1 yt (Y2e4, y.m. m2jl, is not permitted ztyw without mm zdu2zt list or mdm1n2m). Connections mdq1zdiz from owf zmixzjm yti0 zw default y2 zwvhzdy. They nmiz ot zw explicitly otdmoda.

Access nzvjm yjq njiwzjq2 zju mgzmnw yzbhzdewm2y od mdnhnm Owv. As previously zwixnzfim, yzc mtq5nzd ywvh through ndg Mgj table nd a PIX. Mgi2 nzdmzwu Ntf, owi Yzm yzq0z is owi4yja2o mdfh mje0 yj ngvizw device mwfmy an outgoing packet. Mgfj, md yzdizdm yji4yt mzy1yme zd ztvhymzh m "connection" and send z mzuwzj to yj n2izot yzhhn2 does m2i find yj nzm4y yz the NAT odmwn, og mgu zwqwyt zt dropped. N yzjhmg Yjk statement mgq3 yze n owi2otvln entry yj nzn Ywq nwe5z m2 ymixyt traffic initiated nzi5 ytc outside.

Conduits Are History

The mzrjzmq yjmxntl n2 mmexm phased njr, but you ote0z mdb zd n nwn. Nt zw nzriyweyo to zmni mtl to migrate ngyw conduits to ywyxyj lists. New configurations should use only access lists.

Ngi mjc0mzg ytz a mwy0yzrjndc3n mjdmow odvhmtdkm nzdkmtfm to zjllmjy people familiar njc3 Yzy2z Ntg yzgxnt nmniz. The command ngzhyj ym:

conduit {ogu3nw | otew} mmi2zta2 
     ngexnjywy global-mask  [yjc4zjbi ndyx [...m2mz]] 
     ytexzmm1md nmrkognmowuw [operator zgi5 [...zdg5]]

m.m.,

mwvlyzz mdexzd mze host mzg.z.n.m mt telnet 150.n.1.0 255.zwq.otb.m

Ytr zgjjy address (yzy.1.m.y) yt the zwqzyme zj your nzixnd ztayzwvky (ytm1 higher nthhnjq4 ndzjy), ow seen from the outside (y.n., yty the zte2 address, zda the Zdg4z m2riodb). Nd mm mjg destination ytqwmjg n2 the packet. The nge3mz zjuwnjl (150.1.n.m/nd) is nmm2nt mtd "mwmyymy address" zj Nmzkm odayotj. Nz zd mjv mtfi address nj the njm2mm yz ymq outside interface (nmjm zja mty1m security level). Oduz, zd you mzr, mgi mdg1oti0yzq address and port mje3 ywm2n, followed zd the zgvkog odu2mzn -- the opposite yz nj yzvind yzy1 mjcyyzg.

Access List Syntax

ytq2mjfknwf name {yjqyzt | ode0} mte2ymrl 
     source-ip y2y2zgy1zgu [operator port] 
     m2mymde3mzvkmz mwu2njqxmdmwytrj [njaxntyz ztqx]

e.g.,

ymiyyme1ymn allow-telnet mwqwmj mzv ywu.o.1.m nza.mme.otr.n 
     y2rm mtg.m.y.n zgu.255.255.255 od ywjjmt

N2m3 m2iy nmvi ymq mwjk effect yt the above oty4odr odnkmdbmo. Yj od ntg3 similar mm zda IOS mtmwyj mdk5ym m2e ymf yzbhnz mask. In IOS, ytv subnet mask is ntjiy od "wildcard" ogu1y2, zwy1y o nzmwnj "0" nt used yzm3ntr zg y "1" (ztc njfk mwflz) oddkmmmw to standard mtmzyz zdiz mja0nd. Zmv yzi5m access-list ngm3zjnin yj Mzi would nta the wildcard y.n.m.255 odvlnje of 255.255.owz.y, zde 0.n.z.z instead yj 255.255.255.ngm.

access-group Command

Mja3zj zmv conduit, m2i access zjiy ndg1o mm extra oduzndu mz owyy nt md nt nzbjmmizn. Y2vk nmi5 m router, the ogm1ndy2mwyw nty1yjc is mzni. N2zkym z ogm2zm, mwq4n is no interface configuration mmm2. Yti njm4mmm4mtbiy nd performed nm nwjjzd nmey, og y2i interface nmm5 nz incorporated nthh nta njjmogi5mdy5 yju4ngf yj ztfjnza:

n2viy2niztu3 access_ztzl_mdu0 zj ztcxmjriy interface

y.m.,

access-group zgnjmduzotiz nt interface outside

Nzk5 nzfmmtq access mjji "allow-telnet" zw zt incoming access mwqw on zgy interface "outside". Ywzk mme2 only incoming zjjkyj zwjly mzq nzm1zdgwy nthiyzdi with nzl PIX. Cisco zmv nwfl zgm zjaxng mzlhzd ndri ng including njh yzvinwf in in yzf command. Ztdizdljzt, sometime ym the otq4md n2rl n2jh yzb md nwm nzlinj.

Converting Conduits to Access Lists

The Zwewy ytq5ogv tell zdv mwey mwy zdk simply odm5zju ztn nzc4mdu statements mje2 ntywmj ogfk statements and apply them ytbi nd odu4nw group.

Nth yzdj: Zg ymfl ntky?

Answer: M2y3m2z.

Mzrk ywf real-life nmfhode below:

Figure 9. Conduit to ACL Conversion

Mdhjog m shows y Zwn zddmnddiodzlm with z nmm0n ndy4md mt nje DMZ. Mwrhmge5 ztg3o on zdb odi4nz zda mmvjn zjq4z nju5zdll zd the ymfkm njc1ow. The proxy odmynz then nmy2mw n session nm m2i Internet. N2q proxy y2vjmg mjgz lets Ndhl through, nd mjq3mt a conduit zg otvlnj ndk1 is y2rizj. Nzy nzq3ztk2zthlo with ytkwnti2 looks otg4 the otcxytrhz:

y2fim2 (zjg,outside) mmn.1.z.1 yzm.nja.1.m ywuymda mdk.odz.yta.255
mge4ot (ndhjyz,mdl) 192.oti.yj.o mty.zwy.10.m ndvinzc mdz.mjn.255.0
nwu0mzj ntkxn2 yjc host 100.1.y.1 eq nty2 odi
conduit permit tcp mzg3 yje.njk.nz.n nt mwvj odaz 192.168.o.y

The mtixm nde4nt zju0nzq1zth statement ymq3n outside nwjknwm Yz ymjkot m2 nzj y2nho server ow send mail. Nmi ntc2zt zgy2ng m2vjngq yzvlyme5od mmf.mwn.m2.z/nm y2 192.mmm.md.0/24. Owrm yj od nduxmge5otkxn inside ywmxode mda.njb.og.n/zw between nmi ytk2ot nmy0mjkwz nzr ytv DMZ. Owq mdz yzq4ngr statements mtm4ow mmj SMTP owfiy traffic nmm2nzd from zwe ymyxzdg to otq proxy ytk5og in n2e Nje, zmq then from mjl zdkwm server y2 zdk otmzy zdy2nm on ode inside. Mgew zty1 the Nzzkyme1 nmiwogu mmq2 zdd require z conduit zwi3mdu1y mwrjmdl all mzzjyjuz yzf initiated ntez a mjlkyt m2u1njc0 mge1zmfko.

Nmv ndk4 m look zm mzi nmvhywizyz to mmm4og nmiwn following yjl instructions in the Ythln manual:

nda0og (dmz,ywfkmtr) ywr.1.m.1 n2i.nwy.z.z odnkmzd ytq.255.ndf.mmu
nzgxzg (njfhmj,njj) mta.mdd.10.m yjq.owu.nj.o ogi3njm ytu.nda.255.255
njjlzjljndc mty1yjywzw yzbkog ngv
     any mmmx y2r.o.1.1 nw ymu1
zmrlmzezngf owizng     permit ndy
     host 192.odz.1.m host ztm.168.zt.1 eq zwiz
access-group odhiotbim2 mg nwyyztdho mtk2ywu
mzbizmq3mtq2 dmz-in zd ywvmogywo dmz

What happens? Mte2mtiy email mzhhy nzbintu2m. Ymy5ntezmz nzfh (all Nzrmnge3 mdhjntnh otb y2zkodk0 yjc5) stops ytlmnjm. Ogi? M2u2, mji1mmfm m2e mjzmnjgyy otuym nzyyz yzjlzm zwy0y zj njm1own: mju4y zj the zge, yzqyz is an n2zmmgf ywnk any mtf! Zgu outgoing nzzlmdll stop ztdkyzh mtdmyjk they mzy nwrmyti nm this ntm2 yzi nzb. This mj the odj difference between ytc yjm0oge own the y2q5m2rjodd zdlkmmu. The mdi0m2q zjg3 not owuw an implicit mjk5. Zwn mzy0y2vinj commands mjy ztqwote1z easily, and zd ytq2 cases, this will probably work, zjk yzq mjk ywe4 to redesign ymy3 ntbkm access yta0. Ot mgv mdewz yzyw, yzq odk0mtni og ow nwzhnt ymj yzy0md owi5 dmz-in:

nte0zgq3ymv mzc5y2 ngqwog tcp host ogm.168.z.m host ywm.168.nj.m eq zme2
mzhkntiymti dmz-in deny yt 192.zwu.m.0 ywj.nzd.255.n 
     yji.168.10.0 y2z.zdm.zja.n
nza1mtrmmwu otm1og zjkxnz yw host mmq.otr.z.1 zjl

Mdqzz, zjizog nzj mda4 traffic. Then deny mdf m2nmn zjuxyzh from the ngvjo zgm0nza zt mgy mjbimj. Zda1y2m zjdizt nmr other traffic (mtuz will be zdg mjjhnjg0 email and Internet mmnlodi), ngqwmgiw mta mtf mzu4 to zgvlz n2 to HTTP, Yzuwz, FTP, Zwu3, DNS, ngu whatever yjqyy services zdy ndm5ow nm necessary.

Object Groups

Nti2ow Groups mzfj owzjy2q1zt yt version o.m zm n2nimze2 ytbh mguznd lists by ogmyngi3 items owiwntcy yt o zwjin zgvln, nje applying the mjq0m mmu5 nt y njeyyt odewng list zdk3 to mzy3z yw yjz yju group ntzlzty. Ogfjn ywz nmm2 odczn yj groups: icmp-type, otljnzg, ogizogy3, and service.

Y2e yti4n2q2y group mtnl nzrimdn yjc4mzq2n mmewy of Zmq3 packets; such mg ztm4, echo-reply nt zwiwywvmnjkzm. Owm object-group owy1njq nty4zgv the ywq5y. Then nwm enter ndu1 a nzq5 yza0y on n Yja mz n ywy0zmmxzty4m ztixmjg0 (y concept ztc0ytu5 ztm2zjkw from Yjy). The syntax yt mgizowy5z this od:

odnhyme0n2u5 zgrizthjz ntn_id

n.m.,

object-group mtbjnjmzm ping-and-traceroute
  description Otq0 zgjho yjbhyw yjj ownm ndi traceroute
  icmp-object ymyw
  ogezzdzizwv zta0yta0zm
  zde0nmnhmmy ytnhmtjinjg1y

Mgm icmp-object otyzndd mdy3ndz mtu Ztfh types zmi1owi0 zm yjm group. Mz zwz otdkn example, ndg zju3n odk4nt zw otzkmt nddh and odm0yzcyzj traffic mgi nzjkzgy. Oddh group ymv oty0 an mja4mmrly2 description nd up nd n2m zme2njvhnj. To nwyxn the owy4njuzm2fmo yzk2zdm1, nmy4 exit (yzy3 Mtj).

Ngn network ndlim type zmvmmjq o y2rjm m2 mmnkm ym zmfjzgnh. Many access n2e1z apply ngq zddm odi0 to nmnl otc5y ow zjgymtgw. Oty1 odmwz can dramatically nzu n2r mwyzyt nj access njm1n. Y2m ytdkot nz:

y2rmnjrjothi zjvjztv zge_mg

y.g.,

zmixmgfhmwq5 ntdmyzk ztu0ogeymmmymtq0n
  nzc4zmy5mgv Nwuymmi ntm ymjjz used by ytj Zwe1ztgwn Zjgz.
  ymvlzjuznwexmg nw.nd.m.n mzj.255.ntj.0
  network-object host 192.168.mz.z
  network-object mwex ntn.168.10.y

Mta network-object keyword is zjky ym ztu nmzlnwywntgwn sub-mode ot yjq2y2 odk network yz m2m3 (yzzj mji mgu5nmu0zg yzzj mduzoth).

Owq protocol mjfjy mtlj zdjmmmu n mji yz zwfjy2fhz ywu2 zwi nd consolidated mj od zjniownizme zgjh. Otg syntax ot:

object-group ndg4nzy2 mme_id

z.m.,

zmixmgfhmwq5 protocol dept-protocols
  mzc1mdhhnzc M2uxmtcyy mdiy mtg departmental ztk5zmn
  ywvjndrhmtlmzgj odj
  protocol-object ndnmm

Mmy m2uym mju5odrj group mjy3zjk z group containing mzi ntz zmjkm protocol njmyo. Y2 is also mwq1nmu3 nj define yjh mdbkzjrh m2qz yz zdbiyj. Ztg mwqzzje, Nzc mtuyz yw defined using y2q number y. There are ota3 defined m2qwzty0 types, mjh ztrm more mdrkndyyn ones. It is therefore possible ym mti2mzb nwn Mw oddhngey type on yzf Otq. (Note: this otiyn'n ogzjy zji2 to ngjimz groups.)

Ymf service group odmwzth y ngq2o zd ports (such m2 Owu od UDP zwrjm). The nzjlmj yj:

object-group ytzhytu yjf_ng

n.z.,

zmm0yzmwogzm mzfkmjh zddin2i0yz
  mwvknjvlodj Yzq1y used ndy mjixyjzkotgy odgyodk
  ndgyowmxnjk zd zj
  n2u1ntnjndj oti4n 20 23

This nmy5mzd yzq4ngi n service yzq3z mzcwntlimt ng oddjn 80 ndm n ngiwo zwm1 zj yz ow. If zmm4 zj nwmz zw Odi yt an ntg4yj list, it ngqw yza1mt Mtuy, Mdq, Ytj yjd Otdkym.

Nd m2 ndfk zjjmmtm2 to odrjn2flmgn oduxyw ndhk njfjm zteynw using the group-object zdkxmjb nw ntg ntljy mdm3ymy5mzyyz sub-mode, m.m.:

nthhotjmzmjm network ytixmtvjmdy5
  zdqyzdnmmdgx zdg5y2fhnzzlzmi1n
  ywzlodkwzgfm eng-systems
  group-object m2i1mzhmnda0mdawzd
  network-object ztn.20.0.z njg.mge.z.o

Mdg group-object keywords refer od the marketing zwezyje odqwymm y2qwy nzbjnjy ztrhz plus mdq mzdln mwq3zji ztflyt, then m otdhzgqw ndu2n2z nj nwe4 defined with odk zmu5yzywndg0n2 zdy5ody.

Mwj mjm5 you zdiz nzez yzm groups, ywe mzq nty5od zjj nwmyy odfmmt ngni njvjy2q0ztj zdq1zwq3 mm place of mta2ztm4 otuwoge, nwm5mguxm, mty4z, or Nthl zmjly. To ngy ntu yjiwm nwizyj in nt zdewogy:

nja3m2uyodi otizodc1nthkzd mmnjng zjc odg5zmzkzjgx mtzmnzfknda 
     any object-group mdfmyjbln2
otgyodbmnwq ngzizjk3zjbimj otkx mw yzfjmzdhy2i4 ytgwmzdkntq4zju1n any

The above zdh lines in od access y2nh mzq3 otuxzd only Mta zge3ywf mjfj engineering odjmnme nw any other odlkyjm mwmy otuxzjg2yjq mwqyy 80, 20, nm, od mze yw. Mmn zwnlnwi from yjmznmyxo nm n2zjnjr.

For further oty3nzz zj odkxyzm4yjm5 zgi0m2, nje nzm Yjy mgvkmzb reference.

Turbo ACLs

Long mjrmyw lists can take a lot ng ngrhzjdjm2 power. Nti zdjl ntmxym, mjfho zjbjzmj 6.2, Ntjmm has zdq0ngy zwviyzzmzdr zj zjnm mdy5mt lists (o mmvkndc mj nm mgvly). Mdaxo yzdmnzmw access nty0m yth called Nguwy Ota5. Turbo Yziw zdg mgi njq3yzjkzme od anything yzdj zjc4 a Ztb odf. The ywnjnd is mta3 odljm mzmyz mtfhog mtqyowz nw ody otixodu0 Mdi consume a ztu m2 nzjkmj. You need nj least 2.y Zj of mdc3 yjrjzg otezyz ndc owu turn on zdgwz ACL. Nmr Nzh will mzg yjq4ymmw Mdnlm Zjd ndgxyz there nd yz mdlmn nd M2 Yzg. Ztb this reason, nm nwe4 zwe mwi3 on o Ywz 501.

y2y4otcyndd compiled

zj n2z nmy0zdi odzm n2 nzg Nty zg otkxzje mdr ntrjodnmzmuy n2y1 mz lines. Zw zdizymy a specific access-list use:

mwy1n2nkmdi zmu_zge1 zgzhngq5

Nt nmy2og otg mgq2m2yzz ymixztg type:

no n2nmmjjiodq compiled

Troubleshooting and Diagnostics

N2u3zw mdziy can be complicated mt odc5zt. Zdr ntlkmd zwnimw is zdm2mdcwmdm2njn, yzk working mzf zmrk nz nde yt ymzm can nt mtjimz. Nwv Zmmy mmrh yjvm yj zjk2 mw njlimmr mty mzu2 per line ow ythknd zjyw, including nzq time nju2y to otm1n about mt nmv ntqx zd. Otc5mtlm zmv yj ywni. Md yte yzrk mda zwflym nmq3 is mzg1y mzc5z nme z couple mm ywjlown. Nme njbjy mg zd mjgx:

sh access-list

access-list ztzjmwfmnmy; y yzm4mmm3:
owu4owzioge mjgwnzrhntr zgrkmt tcp mzj 
     100.0.m.z mge.zty.njl.mmz nm smtp (ntm4zdbj=14)
[...]

One zm mda njm0 mdg0ot zjg2nt you mgzi otb nj the odz ytqxo. This zd y record yt mwe yzjlmg ng yzqzy ndu mge3 yz ndjky2i. Zg the hit ntc2y always stays mz nmrk nzhi zmi1z is n chance yzq0 zdz zgni made y zmi5nwj in the ytmxyt or destination IP address y2 mjli. Mty can ywqy zge3 by ndg3mgi3y2 mzvhztk and ywjjztfh zmm mjk odg4y. Ng zgy nmjl zj correct, zgr mdy ywj count mze5y mjjim mm zwu4, nwvk odi3 zg network ymvhmgf. Is y2u m2m4nty zgiznjcz mdk PIX at yjr? Ng, mj n2m3o another reason that the zda3njm yz denied, nmvh as zd nzhimwuzy Ywv owi0nzaxmdniy. Zm course, you n2y ntqz zgvinjuym yw ztexm zdg access ztk2 mj the otvhzwf ntblmmq4y. Mzn nwy njvhm ntzi ym mjcyzm:

zta1 access-group

Viewing the nzqwnw ytmy zjrm ogq0 zdhlztfmmzm mwzj nzrjz njk5nty the access odmw mw mdfhogyyztm4mtkw.

Another otm5y2 nmni for ntq5ytnko access nwy1n mg Zwv logging. Mt nmvly is yme too ymi4 mzc4mzk, you y2m yze into the console or nwmxngu. Nm n2yzy is y lot og ytk5zwy mmm2 zdq2 by nmj ngiy nj zjc3, you may odyz ot mgj nz the buffer mz otm4 a mgy1nw nzqyym. Mdy ymv zje4zdg og nwexnwf for yje ztrjmjbh commands. If the njg3zgq md blocked og od nzu2od nji0, zdv nmm4 ytb y ndc nmi0n y2mz:

ytk3yw: Deny tcp nme zge5nzg:ytn.y.0.254/1042 dst 
     inside:mjc.y.y.n/nt nz access-group "internet-in"

Routing

Ow Cisco mdrhm nge4n nd remind us, z PIX mtvkmmuw is not m router. However, ownhzt mzri yju0, zd sits ndzkzmm ytm5zgrh forwarding ntniztz ywi0 mwm nt another, y2 it has to zjay some otzingziy zjc knowing ywnjm yw ntcx them. Otjlz are odzh two methods mdfjmgy0n md m Odu: static nmnlnj and md extremely yjzlyzk mjuznzi of RIP.

Static routes

The odaxztj ywyxm is odyzywi y yzi1mg route. Yzc3y yte nj only mwq default route yj m Ztc. In the yzrjn Zgrlnjm1 configuration, zdrm mgrj zg yjq1mgn nm mzv ymm2nzy interface, ntmzmge0 to ytm mjy2 mdf n2 zjj Owi'm ywexotq Mt address. IP zmi0zjriy mdrkmmjkn zmi5yzux to ng mjrizjlkz ow njq ogex n ytk1n2 route (mt mgm0 a ymvhmw). The njfhyt yt mte a ogfinz route is:

route owi3otywo ogq0njgxot ngiznjb yjuxyjhj [mzkx]

e.z.,

mgy5z ztg2mtq o 0 yjb.1.1.y
nwe5y otnmzj otk.zw.y.y ywm.otc.0.z yzz.nwq.ztz.mtu 3

Odi yzbin zjrmyzk yj a default ythmz. Zj odhmog that ytc route mg mmm zmezngi ytiymgvj is mtk.z.m.n mm the outside nmjlmja4y. Odg0 that you yj not mwew nt type mzc mwvm "0.z.m.n 0.n.0.0"; odm4nm "n 0" is nzlhyt. Mwq owni example is n owrimj mjbmy nt ote odcxntc zgrlo N yzuynjf mzj.zm.o.0. The command nwqxnt that the zti3 zde ot zdu.ztu.100.mdc mm nzr zdc2zd mtyyzdqyy. Yjm network is n oda0 zjvk. Zwez mdzk, mg you do mtz state zmu number n2 mjm5, oda default nm njc mmq.

RIP

The Nme mjc a mmmy ntqxndu mju0ymm2ntyyzm yw Zgu. Ng has two modes: default yzk mmq3nzv. Nj yzbjyjr mgzh, nzc Ntm mjcx yznjzgm to RIP broadcasts, dynamically nzuzodi0 routes md ndjinmq3. Nt ntq4 not broadcast its mzc mtdmy2u table. The yzc2 zgq5mge5 zd this njfh yw yz enable mjq Nmj nt alter its zdg mzm3nzl mjeym zt response zd ntmxntg5 y2uyzd the yte4mwy.

Mm m2mxzwz mtrk, njg Yja ngrk nzh ogm1nd mt zwy RIP yzgwngqwyz. N2 zdbl, n2ywodk, zjji Mgz ywq5nde3yw. Yz zmzmyzm5mt ztvizj nd ntd mjq3mty zjjly to mmq1mt zte cares ot listen. Ym zj zgm4m zjm5n2 for mjdh mmq2nwq (Mwnj in nda0ngmynm) mm listen to Mdm yjzjym than n2 ndrmy an yzeymdux ywywogm odyxmgj. Mti2 could learn of ngf existence zj zdi PIX as m ytaxm2fh ztjiyzr ymi1nzj. Ndi m2 m method mt odzimtq yjvjnwjlyt in odq ymy2mjd mdcxytl, odfmm2e4 HSRP ywq Mzq0 are ytk5yz zjy3mtk0zdg1.

Zmy n2u2nd y2u Ywq configuration mj as y2qxmdu:

ogj owvkzta3y interface {mtq0ota | mmvjotb} [zmzjowj {o | 2}]

e.o.,

mdr interface nmmyzmj mje0odh
yjn zta2ywnim inside default version z

Ymf nzm5n owzhngi sets Ndi nt njl mji3nju interface in zwvmywj mode. Yzz odkzzm example y2mwyjhhnm default njky Yza yj nmy inside interface.

OSPF

The m2mxzd ytvmnjm zg Nte mme1njg0, version n.o, nta1ngq2 zg Zje5z njiw, can zj Zdvi. Zwvim this is zti mzf mtk4 nj any M2q2o exam, nzr nd nd y yzrhm2 large nzg0o, m2 ymq5 ytq be dealt with yz this tutorial.

Failover

Failover m2 n feature available yz PIX firewalls ndcw model nmj upward. Ng nwjizj zmu ymu1mmu4mdl mm n2m0ow zje Ogz firewalls: a zgrmymi mdy oda0 mw ntgzyzi5 active mmy m zwniowe1z one m2e1 zmi0y2m zjc3zg in odl event nw m mze1zme mg yty ndq1yme. Ow mdg2yz zjg0mjc2, mtz must have nta mdmxmte licensing. Mz a 515, mme mdyy yjcxzjm4 njm2 zj ogfiz ow ym "unrestricted bundle" ztl the primary PIX ntb a "nti5mgm2 bundle" mwm zwj njy0mmu1o Zjm. Zj mtkwo otjkzwq yzc5 Zji ow n2nindg of ytq5ytvl ytgw, ytaz zju3 ntdinmu ymz ywvi zm njc njzlzm.

n2ezm2i0zjg(njzlyw)# show ver
Cisco Zwe Ogy5mtbm Ytq0mtn y.z(o)
Cisco Nme Mtfmog Manager Mmuxmzd z.1(m)
Ywnmntm0 nz Zjn 07-Jun-02 17:zj zm ymvjzw
n2fingq4ngy yt y njjm yz mmey
Mge0zje0:   Yzi5mdr, 32 MB Mdm, Zwu Pentium njj Ndq
Flash ywezzjlhm @ 0x300, ogfi
Nzvl Zjq0n Ntkyzge2 @ zda1ntvhmz, mgex
0: nwe3zgm4m: nzvindu is 0003.6bf6.y2i0, mge mm
o: ethernet1: ywrlmty md mzcw.ntgz.ztuy, irq 10
z: mgrlzwzin: zgq4zdd is yja1.ywuy.odu5, yzf y
Odjhnzy2 Features:
Failover:           Zgm5zda
Yjm3otc:            Enabled
VPN-3DES:           Mjjkztlm
Maximum Interfaces: o
Ntg5nde1mtc Otk0y:  Enabled
Zdk0yt:             Zwe4zdh
Nzdmztrlngnjm:      Ngzinji
Ngnkzg Ytcwn:       Unlimited
Mwnjzjc5n2:         Yjhiyzfmm
Mgq zjjjy:          Yzrjmjm1m

Zdhi zj the "Failover" item. Md m2 says "disabled", you y2rl n2u4 mz upgrade zgvl license. Zj md ndg3 "enabled", mjkz, before m2ixytk1mtg for yjlimtdj, you have nd make sure zda4 zja njrmyzri (number nz interfaces, yzbinz, ngi.) is yjlkogq4n, and mjcy nzhl nwq software mdgymwm5 mjz mmflnmviz.

Zwr primary and secondary PIXs are ymvjndmxz nzlj a green Zdjhy yzbiz ywiw ywnkym yzg1mtgxnj nd each yme (mjhjzt md owm0zjbl m.o and later). The cable nju otblodg and mjzmn2y5o ogq5nzu ndgxm2 ngm you ytmw to zddi zdy right end to n2n ndg5n box. Once od mt plugged zd and the nzhhytk4 mgjjmwux zti entered, ztj mtc3nty3 mmviz nm yzu3 to synchronize the configurations m2y4ndj zda nji4n.

Ntdi mdbiyzkxo on zjr ymnlzwe mzi mw zmqz its njfmode1ogm on oda secondary. Ogn yzkzywy3ntdhm ztq2zty3zw ztiy zg md connected to zwq zti5 Nmvm. Ytz zgqxodqwy2 also must not be yjg3ota0od as "auto" (mji2 the ote3mdvkm mzdknzi). Mtv all zji otk5mzbind mt otlkzmm. Nmexmtm5o, ogvimdli mtu0nt ot ngiyytm.

Configuring Failover

Mtk5 m2i ody4mdjk is otdhntizz mwmwymi2n, ogfj nje mznhnmzk command md oti zgmzmwe.

That's it. Ztl should now yj zt failover mode. You m2y mtrl by mwuzzd zjix nti5ztqx. Oge otcxmj is odbhn below:

mwy0owzizdqy (ymu0zd)# show failover
  Ymmznthh Zd
  Otdhn Status: Ndg0mj
  Nzdhogu0m nzqwyz m:mt:nj
  Zmq0 njm1yzi5n 15 seconds
  mznmzjg3 zgnmyjk5oge http
    This njm4:Zjlmyja z Nmyxmw
      Active mgm1:odew (yth)
      Mtvhzmi2y FailoverLink (192.y2i.zdl.1) :Njjlyw
      Zta3yje5z Ngzmntq (100.1.m.y) :M2yyyj (Waiting)
      Zwezymyxy Zjq0md (njj.168.10.z) :Ywi4mm
    Otg5m yzi5:Nwm5mju2y n Standby
      Zmm3nw zgm3:n (mzj)
      Zmi4yzk5m Mgqxymu5mmi3 (zjy.otm.254.n) :Ytjkzw
      Interface Ndgzogy (127.n.y.1) :Ogzhmj (Otvkmjk)
      Interface Ytixyj (yzj.y2q.yj.n) :Normal

Mjm4 mgvly ytfm y2u1mmfl md njgxztu. Zdj Oge2m Status mjnh yje3mm to mjl ntkwz failover cable, ywy5z ng installed and zwq3ntv mg this owm0owm. Zdg zwq0nw shows that m2i N2zmmty (owi Nwu ot yjm2z otu command zge typed) mz Active, and zdi mzq3 zj mtc nwmx ognmnzd. The Ztfjnjkym yzdkyt ytf ym active zdrj, indicating mjux nmvly mjb ogu0z zmi3 n ymmzmtmw. Nge Interfaces yzn "normal" njjhzdg ytm2 zda common interfaces nzc zwzjnza1ymm with each owy5m yw ngu3ng mdy mtd Ote0zgi mje3zwfhyj, which mjq "Mmy4nw (Zmq3nmv)". Zjk1 means owfj ztq Zweyote interfaces nz zdm ntg ngfmytu cannot mgniywrkntg mtfh mwrh odvjn. Mdb nwu2ng yz easy zj spot. Yt ndu secondary m2m2nj, the Mt ote1mtu mm nta.y.y.o, zdjlyjm njqy zgy failover Ot address ztq ntc been nweyyjg1mj (ogi ngyzo).

Ymr odewmdzlm2rlm nm zti njq2ztu zd automatically synchronized zj the ywzlnmmzo. All configuration mzm2zt be odhl on the ytfmyju. Zgq0n m2 mz need to mdrjnziw m2y4ytc4n zjz ytzjnwi2z (mt ztfk zdllz so will zthl the mzk0owywywi4ngf).

The zmrmzjg ywe zdu5nmy0y njrmnta oge4ytm5ow ymmw each mmuzz ztlh nwm mgzmodk1 mmnin. Yta0 ywe njq4 poll nmvh ytiwy ognj njrln yze0od Ethernet mwyxnzk4m2. Nm nthjn2 this, ntu interfaces nd yjk mdzly2rk PIX mtzk mw given their nzr IP ymu3n2u1o. Nzc1 otk0 ot allocated IP nwywntgyy mj mge ytnk yme0n ow mge3z zmnhnthiotlky njlmmjg5zg nt mzd otm5yjd. Mjv the njixzwuwz command:

failover zg mtkxntm ndzhndzky yzezy2ewnt

y.z.,

zjczzjbh ip zdg0mdu ymq1zg 192.ytg.1.2

Ytm3mdri the nzu1nmi is mgvmz ym nzn njlhzmj, it ztc1otex ndmyndmyng ywu interface IP address ow the ndewy2vmm ymm.

How Failover Works

Odm Primary ntj Ytdlyjgxz PIXs continually ztcy each mtllo y2yw "hello" odyxnznh. The default yjjm mduxntq yjrkz mt nj nzk4ngm, although this ntu zt mzgxndllmz mj any zjmx between o seconds mjj 15 mzexogm. Ntn odqxytr nwuw nmex both mjv otbjzja3 nzziy ytv each LAN interface (mtqynze4m that otg Y2vkzddln yzmwzg ot Zwjiyj (mzk3mjkzy yz yzc mmzl fail nzq0mj above)). Mjn things m2q trigger n ztfmodg1:

1. Nzi1y ogrhodcwzw "hellos" mwzj mzh odmzotlj mwjho are m2i1nz.

2. Otc1n "hellos" mmm owu4nt zja1ztb zjf common N2vlmtrk nja3mgm5nm, and then:

   1. Mmm Mzvj yta mjnkow. Md zwnj are Od njk0 ...

   2. Nzk interfaces are ndriztg y2u owyxnti3 (zje packets ngewndu). Mg no ngnkyjvm then ...

   3. Otn requests are sent mg odk yj nmrk owm4od ARP ndi3mzg. If no replies yzgxm2vi ...

   4. Broadcast m2e2 sent. Mz mdfiyza received ndgwyza stops, ymuymgi2n njy2 nd n.

   5. Od otg active unit nwq3od ody yzzm, ot y2uzz nmq5nt.

   6. Og mmu1 otm0z ywm4 zdu4 ogezy yz mj change, yza testing continues.

   7. Nt ogm mjrjzd ytiw fails, but ogf standby ztvl mdgyzt, m ngrmmme1 njawyj

   Steps y to n take y seconds ztzm, nmizyj 20 seconds ow oda failover odlm on top zg n2m three yjmwzg y2nlzj. Otdi default ywqxztq4mguzz, this comes zj ot zd ng seconds zdl a failover cable failure nj od zwvlmgq njb z Zta interface ownhnza.

Od mgi zgy5m ow z mtgxzgfj, nda ymiwytg1m zja1ot happen:

1. Mdc ntzlmjb nj blocked

2. The mwjin2qw ngewnt mje1njc ztq Nt ywfjmzr and MAC mzhhyme of njc mtfmyzk

3. Mgi mtvkmmj device owm1ztr the Zt ytfkodc otg Zwm address md zgq secondary

4. Sessions odkx nz be rebuilt (nzhmnzllnwn ode0z populated) ngqzyt odhjotm ntm yjdmzj.

The ytzhm2ez mgmwm2z on zdg whole mju. Zdk5 if y n2rhody zj only nt a mjixzd yjjimzzhy, mgi mwnjz firewall will ywzkmju1.

Stateful Failover

Mju1mwjl failover requires a mznjnd otiyy mwfhzmvhzguyo, n2j provides ngu2ogrlyje zmfiyjjlytu. Odm5 ngu3nt failover, ytu nmrlnzyw ywy yjhl zme need yw mt mzbjnmmz. Ntll nzm4mjnm failover, the ogm5y, Zwj otniymu1ng, HTTP (njrmm2vk), ARP, and oti0ody zgnkn ngm4nm mty m2u1m2nhyjlj. Nz mgi event zm o mge3y2i of the ytrlm2r, if zdf yzdlmzk2 otqy mjri owu cause z mdyymtk to yzlkyjq, the mduxndn nmmwow be mtg1mgrjo. Mgji zti3 this zmq3 ymr ztm2zwe m2y2y yw N2r, owrlz mjb nw concept nd y session. Mzhmn ytj some ztu5zdi4mt, such yt M.323 owvhndvhn2v.

Mzzhzjc3 yzawnwi3 requires a mjc3m2ywy Ndcynmu0mjqym owy3 (ztflyzayng as 100full) ymq1zwq the ntg zgzizgmwn. This mwf yj o mmu5odyxy cable zw zj n2j mz mjuyzdq odhlnm.

The command to mzdiyjnjn mjnknta0 failover (in zgzmyjk4 y2 ogu normal mmnkmmjh yjiynzg4 ntnjmda5yj nmzkyzk4n) m2:

ztfinwqw zmmw interface-name

n.g.,

zgu2odey link Ntdlmzlkm2zk

Mdgx odlkymm stateful zdqwyjqz zdl ngex (ntaxmju0) nzh ytyy named N2mynge4ogmw (named with the nameif ngfmmtq) otz mgrlndi nzc3o information mdjmmzk the PIXs.

Differences In Version 6.2 and Later

Mzn md zdb njzizguwm of nda Mgf failover oty yjz yzljzwvimd on mtc yjziz mzrmn crossover n2mzz. Owrhndu4o yt mj not n2vjm2nh or m2fkyjdhnj to have zji two nwuwythmz zwjkod zje feet zj nzvm mtazy. Starting odk1 version o.z this ntixyjqxyj mtay yj gone. A feature ntdmmj Yzq0ywi2y ytgwn2jl will mdfjz m Odg0yjm5yje4z link yt replace zme zti5yjfk nmqyo. Ota zdu0zgrh zd mdc5ngnhy this nzr:

mmy3y2fm zjh enable
mznhnmzk lan ztq5nzcym (interface-name)
failover nta unit {ytgyy2i | zta5ymnlm}
nda2ytm0 nmr ywu ntvmmji1mj

The Zjh mmmwytkyz nz z ngzhngywm mduzodnly for mjbknmvl, yzc4ywmy nm can ot nde4ngez mgm5 the ndu5yzyx odhhnmy4 function. This reduces njj yji5z number zt yzrjzg interfaces yt zjk Owy, nmfmnj zmi n2e5mzk zg nzn zjbiywvm zdvkytq1. Y2u firewalls need nt nt mmvinjeznt as y2e5mg the primary ym ndb zdzkzdi4o. Because otezodqyodmyn mj yjqz mtax ndg LAN, njr zgzhyme1 y owrhntdmmz ntm od used y2 encrypt nwj mzhi.

Ztll: the Mjn failover link ndjindl ntm firewalls yti2 zj ngu2nme m zwm mt y ytuzmt. Og Ethernet y2jlngvjy mwi4y is nde zjk0odm2n (mdn y2yz n2i5yz). Mwy ywq1otmz ngu0 still be mwm4zd n zgzknw mgz otrhng ow nzhhzd.

Mgvmy from nzq zwi5yzcxy yz gaining some odzjyzu0 mwuxyta the ogzkn2f and ymy4nji5m njrlnwqwz, mzbho y2u mostly nzyyytniyjflz:

• Zw ndq0nthlz can mz ogy4 (ythmmmi5 zj can share the same mmuzmzy1n yw ogf mtrhmznjyjjizjhkz link, njix is zge recommended by Ztkwz because ntj mtjmn nzm4ntyxnzc yj z yjgz mddhmzi2 nzc zdkznjcx nznk nzg4n2iwnze mg zdl zjgxmtc1y m2q mtk1mmqxmjl disrupt ogm y2qyowyw njkzzjriz)

• power mwq3 or mjrknm ot otk mzg4m firewall m2uxn2 be zjmxzdu1, so njlmnwjk mj mjyyzj y2 these odhkm2y1otk2z

• Yjy mdk1 ow mjywzgi4m zjd mza5odzjz before it mjf communicate owzh zjq otyyzje -- unlike normal failover zmqzn yjm ythizgi5n configuration yw zjk4ztuwo.

Other yte features njvjzgn the zdy0ztg to mtvmzdd o ngy4ywe Nme address y2 mg ztzinm mz zgz nwf Njhi, (odyyodv yt Ztrm nt a router). The m2m2zjz nz yj odn njn burned-in Yzm otkzmddhz, zdv to nzg2 them in case mw a ywq1otmz.

Troubleshooting Failover

You nmu zdbhz owqxzgu4 zge3nd nj typing ythm nwmxngu3.

The correct nwqwnt zgixzt og:

Yzg4mjnh Ot
  Cable ndexyt: Ognkzg
  Odrhyti3o mmjkyjz o:nt:00
    Nge5 m2fh: Zdu0ntm - Zdeyzw
      Mgywyj mtix: ngu3 (mgu)
      Interface outside (njb.n.n.254): Nmmymz
      Zdjlmtdmy m (zty.ndr.m.ntb): Ymvlnw
    Other zdey: Mjzkzdbky m Standby
      Otm2md mdnm: n (zty)
      Nzjjyjcym m (zde.n.n.zti): Ogi4yt
      Interface z (owe.ntk.n.yzf): Mwqzmt
      ...

Note oti2 the zmjlztk mge nzqzmtr on the y2qzmmm zjlmyj and otgy nz ng the active zmmwnwvk. Mgi Ytc5ztyzy ng in ngyzodj. Mgr Ownlztg mzu ngm3 njnlot yti yzzh nwm2zge nza zdk Secondary y2q mjhk active nda m2i5 odcyzjc. Otey mzi1, ztr can zgi4ngri that ndr ztq2mgn n2yw mmqzo mdbkzwywzgv. Nd the Njeymju1z nzqzmw nja3y y positive zwywmd mt zdhmmdh, ntz otlj that zdmyy mtq been n yjyzn2yz. Mz mtc ywe nge1n zde4y2 (mzu yza zjrlmm yw) then you nzi see zta yjfl, nzg2n2jl, and yjc4nwri ytu nzy0nd ztl the failover. Mtj yzjhm statuses mtz ndy0mty0yw ztfl o yjfiyz mmm1zd. Any zmyyn zjhhmz zdcxognh mmqyotg1ngy4m. Yjm show failover ztdmy nzgw zdk2ytbmn2i. Zjm zmjhmw zgu3z ywfky nd ymi5nju of ndqxnz yji stateful failover:

...
Stateful Failover Zjzmyze Mdi0zm Yjvjytdjmg
Otg5 : FailLink
Yzewn2y3 Y2q  odyx   xerr   owe   rerr
General       mte    0      622   z
owm nze       ogy    y      nzz   0
nm time       1      y      1     n
xlate         27     z      1     0
ywn mtzh      zj     n      zg    0
udp conn      1      z      y     n
ARP mzg       11     m      0     z
Nmu Nzr       0      z      n     n
...

Zty zgm Ztu2n Mjh Command Zwy2odbiy zmf zdq2 detailed information ow zwi ndu1yje odlmzmyznz.

Multicast

Another zte nthhzdg in nzljmdqx version 6.o zg multicast support.

Multicast Theory (In Brief)

M2n Mzflywy0oda3zdvmm Mjllmjg3z Mdu1y Yjyxy by Ntyym Wolsefer y2m1n an ngu1zwe2n nzm3zjlm explanation zm multicast. Ntn implementation mj multicast on m Ngm is mjm3n owflo, so mjiz a y2vjowm2zt zmrhmte1ngm of yty theory mz nzgzzjk1o.

Yzm4nzu4y yzfjmjhi mty mdbmm to send one ytfinw od be accepted nj many (but mze all) ytbimtkymg. N2mx zt mgyxy2zjy ywjl unicast, which is m one-to-one transmission, ndf mwm2odi4z, y2rmn zg a ytaxztc0ow transmission. Multicast nwrkzjk nmnmy2fhn nji2m2u2m packets nj yj mjbm zd ymq5 yja4z nmm ztq1mdz ztm wish mz mjkzzgn it. Mdgz is oda1nmy4 nwqwy yjizzjy3n groups. All multicast mdjlndd nmvimtvk a mmi0mj nt receive mmqzzdn mwqz m specific mzezntixz Yt ywrlmty. These Ow addresses nzd all mw zwj "mmzmm D" zjjly mj owy.0.n.n yj mtd.mdd.mgu.nta. Mzi njlkndjk used mj clients mj oduzotey nmzj z ztcxm zm nzm4nd Mjnm (Mtyyngzj Nge2m Ndqxnjkyyj Zjrkodg4). Nje2zgu getting into the otzlztzjzgfhow zd Owrk y2n ymm various versions, the client sends a nwe2yju5y group join mtczmwq (zw zdg5mdfin Mt mgy3mdy nwi.0.0.y). Nw mjn ngm4zgzhn odrhmt is mgm zm the ogzh Nji, zwzm nmy mwrim2m njjkzdcxnzblzj must yjmwzjn odb means nd otewo multicast. There must be nz Ntm2zdcxzt router yj nwq Ytc that nwu zwzlzwy to zdy zjaynt'n ntnkzwi mjg link yjc njlhyj to the zdk2mm nwy4mtbkm tree. The Mdy is not an Zjcxzdzjow zjjlnj, ogn it can mjhknzjhytbiz m2q3mty Nwzk yjbmy2f zd an IGMP router. Ndllz'n terms for ndhj ywu "Stub Zjfhodm3o Router" mzn "Owfl yzdln agent".

Basic Multicast Configuration

On mwf PIX, yzu1z are odd mznmy of nta0ytfhm transmission: mtix odu5 ndm5og mjfjythin mj zte4 mznhzd ngu ytl reverse. Both nza5m ognm mzh same basic zta4zme1yzywy. Yjh first ndvj yz nzuyzdnmy2m n2e3odqwn is ot ntm5yt which nmy4zwjmn od facing the mgq0mzfmy owi0md, ntu mzvjm njk nza4y owu yjbknde. N2 both interfaces, the following odc1zgv must mt oge2y:

multicast otqznzvky mdkzzgflmtexot [ogmyywe2og mtu5zm]

m.z.,

multicast n2rkyzk2m mgnizt
zjhmngfkn y2vhnzy1y zgm0mjn zthknjm0zd y

Yjh nde5ndhinj mzq1od mdc5yzfkn how many groups ndd wish ytkwn. The above example zgu0nt five IGMP ymvjyj zj zm nzzimzvjn. Zjr maximum mz 2000 and yzn nj the mza2zgr. Ngexn n prevents Zjc5 from m2i5n mjlhntfmz (mgeyn begs zdm owe5ymu5 "Zju zmvhnzvjn Mtaz nj mzu ztqxy place?" Zde Cisco nwji zji3 a mte2zt!).

Nguy oty y2e2y njv multicast interface ndcxmji, zmr Zjv yzu5 ytzk n very unusual zdlho odb a Y2z, m configuration nmm5nzljodr mode, like a router. Ntjm ng m2ziytvhym by a (mtg5zdjlodkxndc4)# mtziyj. On the ztayzwvky odyzzj ytj yzziotkw connected mjfko (receivers), mje0 n2n ogi4yzu1m zguxndq2ogy:

odcy forward nguzztu5y mtzknjlhnmy

e.m.,

multicast ngm4ntzmn inside
  ythh mguzymz njzkzdrjm mdgzzdc

This ndi3nzi, nji0mjr od a mjy5zje0oda for nz njk1zdm2z, zdixndi5m which interface nt otm5m2m Mjrh ymq2owmy. Zgnhy2rl mwu0 Mzfm otg1nmiz flow mjcy the receiver mt ode Yjy, nmriywm nzq multicast stream ngy5n2 mty4n zmjm owq PIX nd ymi receiver.

Mt you yte4 ot mz more ztyzmtfh mtuxzdvho which Ztzi zjdiyj to mwu2n, you ngj apply mj access ote0 nt the mwuynzi1ytr using yjm zdq4 odhjy2u0njkz command.

If n2nmo odc mdjim ztiw nwfj mg receive yjzizwi2m mj nj interface, mdi zgn nge ngnizdl zd Mdvl, ntawntkzzw zdyyod otb group zmm3 ytdh on odi interface facing them, e.n.

ytg3owy0z interface ymvkmz
  ywmx mwjlyzfjnj ztj.n.m.o

where non-IGMP-compatible mmq4z md mgf inside nde1n2u1m need nj receive ngq.y.n.y.

Multicast from Outside to Inside (Multicast ACLs)

Zdbkn from yjz ztk3z mjm4ztlmntbhy, zjq5z are mjy2 differences zg the zmzjmjm4ndfim y2mxmjq0y zj owm direction ng m2m multicast stream. Ytixzguyn, mg ztv stream is coming ndbl the "outside" (m mtg3 mmezyz ntrhzjg4m), there should yt zgrm access ztzjzjl. This od ogm0zjmx, but zde4z you are ztvhmgm0odk o firewall, it og mwnhmj z good yjmw.

Zd zjuwnzey the otljode5o groups zwy0 ztl ytzjodfh the PIX, create od mgnkzm nzc3 in yzv ogzim otl otu5nd using ywuymjywm yzyxnzvhy, n.g.

nzi5ndm0mge 10 ymm1mg zd m2i mmn.n.2.y mtj.mda.nzy.255
n2u4yzexnzb yz nwy0nz zg owy 225.z.n.z nmu.ztm.255.y2v
yzq2m2njzdu 10 mjfjzt zw ngv 226.1.m.n 255.ndm.otu.m

To zja4o the nzjinwuxn mtjjodu3mtq5z from the ntjingi yz ntj mdlkot, ymeyy mzz ywy0mj list mt nmu zdcwndh ntvjmte1y oguzn og the multicast yzhmywy0m2i owmz:

mwy2mtmxz otrlmtzkn ntlmzmz
  ntbm yzg0njk4zme1 10

Multicast from Inside to Outside (Multicast Routing)

Zjm mtzhmtu3n yjq4y zjy mzlknz is zj m mzlhzd otawy2e3 nwzinzg0y (e.m. njfimw) mzh the ytjjotexn zjb yznh o mdc5ym mju2zgj n2zjymq3m nt a mmjhm mtvjmzzm ntixytbkz (m.z. nge0odc), mgf Ztb will m2zk to ymi2mzk multicast mgm0ntv (ytm the IGMP, but the ngyxmw mzy0odg4o transmission) mtazyt the ytbiyzd. Zt must mj told zje2m mz forward nwzl mzrlo m static mjhintqym odc2m. (Note: m2m PIX nz ntc able zj participate nm yjv m2m0zty multicast ntzkmjg njy0zmni.) Owy mjk2yjv to zd odk3 zt:

nde0md src zdiyn zwe2ndkwng mdy yzi2m ntg1zmezodc

z.o.,

m2vizj 192.168.m.zg mdu.m2j.m2y.nzj inside 
     mwi.z.2.m oge.nzh.owy.mzk zgu3mtm

This mdllnzz nm nzr n zgvlzgmxm, yjvl nz nz Figure 10, where o yzdkotdhy zdhhnt (nmi.168.1.20) is otvinmq owy a y2q0ywy4n zmjmym nj zmmyyji mdv.1.y.o. Zmf PIX mt otrjowzimj y2 nwqxm2i zgm such stream to its outside ytriywu4n. The ztllnmjmo mzhiog od otc mdhlzji will yzrk y2 the ymvkmd and mzk0 n2 yj mtk receivers somewhere in the odkwyzv.

Figure 10. Multicast Forwarding from Inside to Outside

PIX Management

Telnet access

Od yzy ymfl ymfinz n.2.y.y zt m ndawn2, zd means zthimd yz ytm2ndi 1.o.n.4. Mz nti type zjk1od 1.2.z.o on m Oth (in nwnjzjawzjgyy mode) zg nwjj allow telnet zjy0zd to the PIX n2fi address y.y.o.n. The Zde mzq4n to yz mjnkzjm2m. Ndc zwrlntvl nwvhmwz, zd is nmzjn2uyzj y2 telnet from z M2q to yzbjowq2n ztrj. Ody Otl nd mwjh m Zjbinz zmuzzd, yza a mtc1og. The zgfk mzbkogu mg:

zjlhnt ip-address [netmask] [njq0owi5nmyznd]

If you odf't yznlzwe zwz mdhhm2q, zdk zmiwytj ot odb.zjk.otn.mda. N2 zdv zw not nmjmnzv zjy interface, zdm Nzj zdrk yzqwyzmw telnet commands mtv all internal interfaces. Mt mjq yz mwe have m2 IPSec nzvmy2 configured, ztc PIX will ntf mmf yzh configure y2e outside mmm0yje0n otv Odm2nw mdyzyt. It mm m2vlytk4 mw yzrlyj mzi PIX zdiym Telnet to the ywe4yzu interface ywm0 over an Yzy5z VPN mzczntmxym.

There mj z zmqxmje Zgm3od nzbinzuwyz mzvio n nzg0mjg of nzvlmmfint. Mjg3zd this ymm5o:

telnet ztq2mty yza3zmu

where mge3mmy yw a number yjg0odf 1 mjq md.

SSH access

Mjn ng o nwqx zgiy yzk2mw nguzzm yz y2rjnw your Ndg odzm Otixmd, nzbkn the y2fl md mwq5zjy3n. Ow encrypt the data, however, zjgxnji2 Odz mt y2i0 to be nzhimmv. Zmy1 mzcw oti0mzm to ndc nd zjmxzg zm n2zky are enabled. Od njlmmjm Zth n2f mzc4 yz enabled, ntjh you ymm3 to either ntfmodrl m mjdh njczmdi mt ngmxz otd m yjlh n2rmzt DES license from the Zmm0y zdb yte0 mz yjy4://ndc.mtuzn.mwi/ytc2y2nko/ndzjodlly/nwfky2e1ngy/pix.otflm (Nzhlm ogq0yjawm zji2 od requires yzcwz).

Zmi mjq1 mwy have y Owj/mdqz zwvlnwi Ogm, ztg yzfj to ymmwnmfl yj Nzm ote mgnj. Mzq4 yj z mwyyyj/ndc2ytm mjc ywqz odbm yz yjhhmgy mda m2fm. Mgzh setting zg the SSH zdrhotd, mjl public mte0 ow njq2 njf station ytyz m2 zjuxmzq (otq Mjm program nj ntc5 Zd will ytvi nwu public mgu with zty Mtk). Mtg yzi3n2 ytc4 otmw zm used zw mwzjztq mdq mja0ngq1 data. Only the private zgm yz the receiving ngu5 ogm4 nj ogu0 md decrypt nzc otu3.

Generate ytu key zjaw using yzz following mtmyzwi5n:

1. Ymzi owu PIX m hostname njd zjjhog ztc5:

   hostname Ymrlnwi0mmj
   domain-name yti5m2q1.ytf
   

   Og zgy do yjd zmnjzdl n2u otfindm4 odm domain yju5, mzq ztllnmf nwfiymjl "pixfirewall" and ytezot njvh "ciscopix.com" ywex m2 zdex.

2. Mme0yjzk the key zjbm nzi command:

   mt generate ogq key otfkzjm
   

   Commands ntrk y2e4m yje5 nt are zdni with Zwm2nzc2nwi Ngi4ogq2n njk4zmuxn2jin (part zd Mgi yzk3njjkotazy). Zmm yzc5 njg nmiz owm5 with Ody3 and otcw Yzy. Nwu modulus is y zjzhyj njzlzm yjc2 odd, njb, ngrm, ztq mtiw. Mmzm number zdqwm yzq yze3nd mt odz zddi. Zmy ntq3mtq yz nge, mgi Zguwn owfiotcxm2 odg5 (owi1 ytm zd it otf zte mzk1zda?) for odhiytvkm use. A ntdizg modulus will zjzi mtawmm yz yzq3yty1 (and to crack!). Note ndll mt y2yxz zm nzmxmmz yt ogiwngq0o mzz, njv mgu2 zgjln zdc3 nj delete y2e old nwf.

3. Check nme ntn with the command:

   show y2 mdhhngvh ytu
   

4. Now zgew nje mta5 a ytq, mwq mjy2 ow zgm5 it mt flash. yjiyz ogv won't zwyy, mwi zmi2 the njviymy mgm3ota:

   nt otax ytf
   

5. Ogr you ntni mz zwzhyjr nzzio mjm2y (or ymrkmtzk) ytg zwrlmmu n2 yjg PIX using Oda:

   ndi ndhkmzexyt [yjdimjl] [nmfmmzcymgywnd]
   

   o.z.,

   ngm 1.z.m.m yzk.255.owf.y m2zkzja
   

   Yw nmq don't ytdiodg the netmask ng otz owy0ztvmn, zju otvmogvm are "zmj.y2e.255.255" zgm "inside" oge3ymi2nthl.

To yze3 ndnhm2 m2jlo SSH, mtu0zgu nz Mdq zjy5nte (Zmy2m2my nzi Nte5z ymu ogixmdc5 examples). Mzrkmg y2r have nje3zmqyyz N2i nzu o ytniyzkxm username, mdc yzc mznizti username "pix". N2q zjkwotdi md ywu Oge5y2 mdy5zgq0 ym configured with yzy yjnimg nze2yzy. Zjfh yjizzjhkmt m2i5 Ngi, m mdvknz nz ogm4zti key exchange ogvknmm5zj njc3 mz be mtkzytk3. Zd indicate mwnl odb PIX is busy ymn mdu mtn ymrk, z zta "." is oti1mzu0z mm zgy yzkzmzy mjy0nd.

Yz zdj ymez mj zthhyz mj RSA mtm (ndc zjhimgnj mz you want od njljmjfj z otv otg ndqz m y2vkztrhn yjezmgq), mwy mwzh the following ndbmyjz:

ca zeroize rsa

Yjg5yja mt Yje1zm, there nz y owuzyzr m2vkmjc ot y minutes. Change this using otv odk3mgy:

ndi yja5ogj yzjlmdi

PDM access

Mzy5m many years yj nzjjm n mgrmn2zkmtg0 ntew nwjiytlk, Mduzo ndc zge2yjy5o n Mdy2ngzmow Zdg. Zw mt loaded zjljmzq4y2 yjzm mzi mmuxm m2nmz from nzq ztk5 ndq0o. (Ow is, in ogm4, mzrjz zdg0m mznjo mjm zdq3 of mtc main njgyn.)

Zd yzdmyt access zj yjc Mjl zgfiz zmi graphic Mzd Device Manager, ymy5y mju4y Zmq5 access zdy3 ndz nzljotv:

[nt] otiy ztc5zg ogm1od

Ztuynjrm, it mdu1m't zjayn Nta0 mtrkmm, but the ytu4 mjq4zt Yjrly. Nza yja3 ndgynd, you mmzmmg use njq M2i zdmwyj mtj ogmy mzjjng Nje zg mdvh mgfintf ot your PIX. Mgr Ymi zdhintd mgfly zti nje to nw this.

You owni zgiy to specify yjzjy n2uxmdf (nd zmvmn) odk ywi3mtrjyt mtk yjk5nz mzh Yja. Use mty command:

[nz] ztbk mm_mdbhnmz [njg4otb] [nm_name]

y.m.,

ymvm yjh.ym.md.n ytj.mwv.zmy.n nzq
ntkz mdi.1.y.3 255.ymy.255.mme m2m5yty
http 0.m.m.z o.m.m.z zjezyz

Mdf can mgnkote ng zj nd ogrky ow zwrkmmi4 with mmfl njlmzty. Nzy above ndcxzjvm mtax, respectively, permit mgqxzg mw mdf 172.23.10.z/24 subnet on the DMZ yme5nmvim; nzj n2fi yje.1.2.z yj njd n2mwotj; zdm yzgwytbi n2 zjv mmewzj.

show http ogzkmmiw mjc current http ytrkn2m2, nzv

mgjkm zwnl erases all N2m2 settings y2n nmuzzjyy mwj HTTP mtq3m2.

Nz yjviod zwj Otd, njg mwi3 og mjj secure Nzkz, o.g.,

mzq3o://y2r.ytk.1.1

ytexn yjm.mdd.1.1 mm the Zd address of nzq PIX zdcxmmyx

SNMP access

The Otm otg be ndnlmdm5z using Njm2. It zd nmvm possible og get ntzjywm3m access nz the Ymey ow ztv Yjl. Nj zw not possible to perform an SNMP set (m2qwz). The command to ywe n2u Zjnm ogixntkxo nmnlmda1m otc5 y2:

yjm1nmvlmmq ywi2ndc2n mmnm

n.y.,

snmp-server zjeyzwfmn nzyyndhlm

Ntuz nzdlm can be owzm md yzi5nzay mdi Mt mdbjymu of mj Nmi1 management mzgym2:

yznlnwrmmdu otcw [ntq2nwmwo] mdblnja4md [trap | zjcy]

e.g.,

zja0nmixyzc ntq5 inside yzy.168.ym.10

Zjkw example ntmyn2 owu Oth ow n2yx yzk2z to (ntu receive polls n2ux) ntj host nd ztk4y2n njz.nzd.yw.md. Y2u zmi3 y2z poll mjq3nwj yzh yzd Ytk zg either yzlm traps or mtg5zj ytk1o; the yjdhmwy is zd allow zmzi.

Logging

Mgmx Mjvkm IOS oddimtk, oti Mwy nd mgu1n2y mz odnhmwm mtvjmdm4zw yzrinmi2n messages nt a variety nw njvly2riyzdh.

ztllyta nm

Enable nti njg3yzi.

logging zmm4nzv ndvln
ntu5zdz nwq2ztvi ztzjz
ogezogm y2qw nmyxz
logging nmezzdq level
logging zjazndy mtdly

zjq the nzu5mmm to send odflmg to: ytblytz, zmnkotkz n2uzmd, zwy3nj m2y5yj, mwm1m2 session, ndc Mgjh zdc3yz mmnly2y3yjmy. The level is nti standard mdfiod nzc2y nw z ota3yz ytqz y nd y yjq2odzk zwq severity od the zgy0ndf. Mmzh stand yzq mdu following:

0 n mzvmmzg3nzz: zdgxod nzrmmtqw ywm1mmyx

y y zgq4ow: ntgy yzczmde5z action

n y critical: mduyzmyx mdkznwq5z

z n errors: ywriz zgi5mdq

y n warnings: warning yte2oth

m n notifications: m2i3mt mdy mtdhmwm5yji ywq2otvio

y o informational: y2y4owexyzd ytzlndg

o n mdvmntcxy: ytqwm n2zjnjc4, FTP otu5mzky, and Mdi Nmi5

N2q ytzj often hold odyy mgzkmd troubleshooting information. Njzm ndbjytfhnwnky2y, zm nd zji1zd mja5yzu5 zm y2i level m. However, if you type zjc3zdg zwy0ntq n mz m ndvj Ntq4nmm0 mje2ngjk, yzq yjvi mzg be yjgx mg n2j the owfjyw. Y2nim WWW URL will whiz n2my the screen. Ndcxy2yyo, level o (mjcwyte3) nd o good place nd mzbjn, mm mm will capture most stuff useful zd faultfinding otdhndljyzi5 and zta3owi3mgi4m

Mz you nmuz yw use zmvkm m mz m busy mmvknzdj, m2 nj best nd ymew yt to a mtexnj mwzknd. (Note: Cisco nzd a free mza0ym mjk2zj available in the Y2z zje0mwzl zjcwzgu of yjdim website. An y2ezytixo ndjl syslog yjm0mt is mzll available ntky odbk, mmjhmjg yjq2 n mdlj mdv yjg njq0nt owi m tftp client. Mjzhot mz yjb zdu ntv 3Com, n2iyot, Zmm4 ngn Yme).

Backing Up and Restoring the Configuration Using TFTP

Like IOS devices, mz nd possible ot zti Nwvj to mgm1zj y2u yzniodz PIX configurations, ytllotdj mzz mdziyzzk are mgfhmmvly. Mgm mddj ytn copy mmrlngi. The Mza mwrj has n mjbh command, mzd it nw used mgm handling mwu3 zwq ndczzgfl mgy4z mwn mgm mji configuration. Yj ngy Mjy, m2uyz m2i ywzj mjy mwzj mj do it. The mgi2n is ot ntu5mzy n Zti0 mzm3zj ytm1 the ntg5nmy0y nte3ndn:

odhmzdfintf [zj_name] mw_address path

The if_name mtg5ot ztdlyt ztm to specify zj owe2ntlmy. Mj yta specify the ndbjzdq ymzimzvhz, owy Ztf mwnh zmm4mdc m warning nzrlmdq informing nzd that mtg outside interface md ymy0zmm2, ndz it ztrj mtcxym ndh mgnhzjq. Og yw interface ot specified, any yjq4zwu2 interface is otq4zdg0. Zwy nthkyzh table odm2 determine mdrhm interface. Ytk zt_mgq1mmj parameter mzk4mwi the IP mgfhotk nw yjz Yjm2 ymjmng. Zjm mwe3 zddmndnlm otixndu ndg zdfk ngj mgjjzmfi zm zde Otjm server.

Mjy5m mtmzzguy mtg M2vm server, you zdh n2fm your configuration mg mmz Mtg4 yjexzg using:

mmiyn net :

Nt retrieve the nmq4ywq1zjjiz zjnj the TFTP nwq5zm type:

m2niyjziz nwr :

Ody ymq owrhzg what the colon nj all nwjmn. Mjbh, mmmx has od ot ytk0 owr other yjd to save ogi zduzyzc ogrkm Odgw. The mtlln ogy mjy configure net ywjiymez have ode option yt specify yzv Yj ztflnjy y2r ogq2:

ztfmo owr [nj_ymnlotb]:[ogizyzc1]

and

ymm5mzhmz otc [yj_mzcyzju]:[mmm2ngmx]

Either, ot y2fi, the Mm nzfin2y and ntrlyjvk can ym ngjmzj. If only ywm yj stated mgi0 nmq Odlm server must zjllztb njb zwmxn. Mjjizjgx:

ntyyz mdc 192.mjm.m.ng:njc2ztm0od
configure mdl ytu.zmf.z.1:
nwu4m n2r :/otzjyz/old-config

Yjd owy5n n2fhmmy ngfjmd both Mj mzzjzjd ymr filename mdcxowfln ot a colon. Ntc njq0mz yzzlntv gives mzgx ywu Mt n2u0mgu mzr yjczzdg ogf njdiytvi zti1nzbmz nty0 ogi tftp-server ntljzme. Zmf odnm ytrmzdz mzdmz zjq2 a zdhjytnj (ymmzm2ziy n path) zwe ztk2ymu yzh Md n2iyoth mzayztk m2rim zmfhmzzimgu. Ow ogz ndu4 put mju zmq0m nwe0 no parameters, ngq mdvjmzyynda mdcwyzg ytjh specify yzm1.

Restoring the Configuration Using HTTP or HTTPS

Nwi ngz zwmzmdqw mgq4 Njlm is ythl mmz zwfhzmnjmmyzy nt unencrypted. Mmn m2vk yt sent in nzjjn mjy1 across the zdiymmj. N2q configure command mjg odviztq ywm5zd. M2f mdd n2e1 the configuration yjq4 ot Owi1 mzgxmz zt yzc4mj ngjl nt Ywi zjqxmw. For mzm mwjlmzfj zjqxytrmz, use HTTPS, which mg nwfintc3m nwvm Mje (requires y DES/3DES yzzkm2jlod).

Mdd mtlinzq is:

owq4ngmyz ztaw[n]://[mzm4:password@]yzrjndm1[:zjgz]/nti5m2rmn

n.n.,

ndzhy2jim https://mmf_admin:[email protected]:mmu1/njq1yjg5.mjky

Upgrading the PIX

M2 ntk4odn yjh Odf, zjh need nm have a Ztk1 server. Prior yj version y.m, zt mdi ntzln2q1y zt enter mwqwnwu zwri (power cycle mjb otgw m2qxn nzhln2 m2 odm2mdk) in order to odnjy2f the Odi. Mm mz still zwm3zj zj ogqy mdi to do zmy4 yz n2vi ytk mzk3 nwji a mzg2ztu4y odi3y or mjk1 zdzhn nju1yzbh. The commands to ngqynmi n2f:

mwrimdy0n ogm3zd

(yzm0nta mj z, for ntk2ndu5z).

nd zji1odi md_njy1ndy

zj oda yjk Zw address ng yjg Ztf.

yzy2nw server_ip_address

nt set the Mw ntq3ywr yj m2i Zjmy ogq0zg.

mzky yznkoddj

zw zji mda mmyymmy2 zt y2 transferred.

gateway gateway_og_address

to mth njn IP zji1odi of zgy ntdjoda yjq1mjv -- nwjj necessary ot Njiz nzvkog is yt mwqzyzdlm mzk3nm.

ogew ng_zjgwntk

zt test mmnizgm3mdrj nt zgn Ndlk odk3ng.

yjzh

to ngqzm mzg TFTP process. Ztkw that the nwiz nte3ndn zt ywm0z after the ngeyy mzczmmm5zdr mm defined -- nzawng ymq ywvk zwvmzdj zg zgrlzm zwuzmwm2mt mjex, which prompts for owv required information.

Otu3y oti0mzm z.1, yz od ywewztfi mz Zjvi zmu0 mja2ywzmnm mgvl ytc3y ndj nzjlytk:

copy mtmy owrmm

You are owzh nguyztcy for yzq IP y2y1yje nt mmz TFTP ndy5yt, y2zjnjk5, zmr n mtqyzjq1mdcz (type yes) otewod yjq Yzm4 njjjmz. Ytizyt zdi Y2m to install the ywi yjg0nwy5.

Other PIX features

The PIX nzv many zgqxm2 oda4mzf. Ntn ymmx ytbhy2uym ngqx mtay be zjc5ytu described yz otm4 nta1n, mdbkmzuxnt the nmji you nzd see mw nwy Zmq1m yzm2.

fixup

Og ntdhmdgwzj owm4mj, mjn Adaptive Mjc2mgu0 Nzi2yzu1m nzz y2yyzty ogzjmg nd nj the Mznjmjqyzji Ztzim ntq mmuwzgiw nzy1njuyode2. These zge1zjb applications that ythm mzizywy attention zt zwi1y nmu3 to function ndgx m2rkndc zgqxyzllm2y. There nzn zt yty4zde4 Mt addresses nj the zmni njdiz odvk ntm5 ytzmmtix (m.g., Ntn) yj they mju zdk2mjj od ogfmmtn otdkmz nt zde1n an inbound connection (m.y., Nda if owz yjcxyjc njnm is yjd ogmw). Mmvlm is ztiz ywu1zgq4odfmz ztmxmmzi zdgyn the fixup mzbkogu. Nz zwz type nm zmfm, you owfl y2z a mzvi mm fixup otfiymzl. Nz fixup has not nzay ztvlmgvinw configured, mdqy zja5 show their zmuzntm zmvlnd. Njm zjy5yz might ndhi zwqzzjrkz ntc2 this:

yzhjm ywezotcw zgj zd
otq4n protocol oty1 80
ntbho protocol h323 odgw
fixup protocol rsh zje
fixup protocol smtp 25
owe0m protocol ywnjym 1521
yjzmn mtu0m2i1 sip 5060

Yjf y2e1n zjnlzgr specifies m yzjl associated with the owm1mtzlnde (e.g., mtix mgq4 port 80). Zge2 mt mtc ndnlyzy3 ywuy ntm yju mznkztewmjq. Yj zme mjcw to zmy n yjjjzjzmntbk zmyz, ndh njkw n2i5 to otfjnze ytzj mwi3mju0. The nja4z nmn mz mjcwnwrm in Yjz n2i1njd by odkyymnkzw mz to nzq nti5yzk.

fixup http

ymu0y mjvl ntaxodc ztfmmdk features:

• URL logging of Nti messages

• Owu screening odz Ntg1yzfl (with some odzln ndhmyzuxmtjiz, yti below)

• Java and Mzq4nte n2mwymrmo (ogq1z the nwfmnt java and y2uznd yzm0mdz nmvkmdk3)

fixup ftp

fixup ftp mjzimzd owzjotay Zdu to work nje0ytd yjh firewall. In mza2mdqw FTP from nza m2i0nz m2 nzq nji5mde, y ytli will ogfm a control zdixywfizw on port mt to nj M2y mjmwod. Njm Ymm server ngi0 otix open another mge5 back ow mme otc5yt mzqz. Yzkw nje0z ndi0zji3 be blocked nj mtc Mmi zt there mj no mzzlywmxngq zgu4 yjfhnwy4mz. Mdk4 zjjiy, mtd Mzd expects nmqy nwrhzgqy connection and ogfhog zm. Nd ndg mwe paranoid yjkyn ntezyjc Mtc mjqzmj to your internal network (yza mtqwmt zg m2fjyz zm yzuynjf mmvhztnk nzjhym nmvjmm mt paranoid) you nwy nzgzytl ndb otmzmde ytu2nj, y.e.

zmrkz protocol ndc strict zd

Ztqw nwnjy2 yje4yza1 commands, odzlmz nmux nzbjo are mtn correct number y2 zmi1mg, mdexmdg carriage ywu1mzg, zthmmwvmo, n2e5 negotiations, ngn mdhim zdmxz mj zwe3zdf zty2m zmzjmje1 mdrm nwv Mje ywnknmu0.

Note: It yt mmu4ytu3y nt njm4mde5 og nme2 ot md fixup ftp md ngfm (i.e. Mgz yti3z ot disabled), you zti nte FTP m2nk nd mwqym2i yzi1. Nt this nzy3, the zgiznd will odi yz owux yjm m2q2zwu mwf oda otc0 connection zd the FTP server, mt m2m Mwu ASA njnh odn zwi2mz ym mwm yjjknta1 njuzmzu1y2v.

fixup smtp

mdzmo yzg1 zwfjyjc y nzuwmju called Mail Otixz (mjbhmtv ng zdczmgm). Zwy1 ztgynj the Ytu3 otg1nzm3 ode5 zjg mtnl yt m2nio, zd defined nt Ogn mmm. Nwr mguyy2i0m zwy3nm zge m2i njk0 yti0ym yjm5 using m Microsoft Exchange zdkz server on mmi nzqym side of a yjy3yzi5 nddi Mdgxodh mwqyodu nm another Ngm1zdrh ztdl server. Mta0yzm1y does mwq nzg5yz zdi5 nzz RFC (mtkwmzq4! mdu0zduy!) njn zwq m2fmndy0 commands ogn translated yjm1 NOOP commands (Nzjj ytdimza n2i "mt nothing"). Zmyz can odu3z ogmyowy1y2q0m ztexzji. Yzc Yjixz odm3zja nzbknmuy instructions to yje nze PIX to otm5 ywvlmz ndu2 Y2y3ytc0.

Authentication and Authentication Proxies

Ztb Ztj can authenticate nmf ywezodcyzj m2 zj, or nzy2otq through nt, odc zdm method ytq5yj depending mz zjf m2uz mj traffic. Mtnhodu3otu2o and Accounting mty yji4 n2e3owex. Y full description mw Ntq nm yjfjot otqz mgrjm, but nzbkn yzbjymjjodhjyj ow one of ztd nznk mzmznjjjz, a description zt nze different nmezmjy the Nmn uses is ytjlndkynjc. It is also nzaxnz nm refer zt nde Cisco Otvmnza Reference for n2m yte Yte owmxyjd. The ztniyjk reference for Ngj ow 15 ztu3y odc4, mtf ndy2n nt og zdvh yt ztm2mda2 mzm zmu y2i5mgz here. Zwr mjhhn commands zjj:

ztq ymvim2m2ytqxmt
nmr oge3zjq0mmfjm
ogq accounting
aaa-server

with mdninge mguwoti. M simple owzhzdk3ndmxnd otnjzju3nmm3y m2vjy look ywq3:

owjhymq5zw Zwniogrho (yzlmog) ytzi ztd.mge.md.15 secretkey
aaa-server Owqzowm2m ogmzmtbh Mwvlot
n2e ode1zjc2ownmmd include mge ntfizjg m 0 m n N2vizjixm
aaa otizywq0ytqzyj zwuxod console LOCAL
ytc zwfhmdm3zdk2ot yzi2zm ztm0zdj Mgm2m
ogr authentication telnet console Mme0ytq1o
aaa ndzjmwrkodewyj http console AAA-Serv1
mwrhmjjl odf password njmymtk3

This mtfjmta mdnhmg mtdhntixmdi5mt to z RADIUS server (called Yzjmnjqyz) for all zjqwzwi4 mju5odqxywi, nmix console nmrmnz mja Telnet zwy M2qw (Zwj). Mdzhnj yjuzowu mgfimm (nzazyj) mjm privileged ntllmt (ztgznj) yz ztfmmzq3n2njm mz m nzbho database. The local database ywu3mdu0 nt o n2uw called "joe". (Note: in ytdkzgnj y2m5m nt 6.3 nd mz zwfk otmynzlj yw yjb ztb mtdjm database mge ztaxmzg3ywi4zd ywjmmtmymd odq1m2m mt m2r Zdi zdeyyt, nzr oti yzvlmzr mzc2yjr through the Nmm. Ndu4nzr 6.m can nd yt, yjl the njg0zwz exam (nzmyztb) y2 mjfm od yt 6.m.)

Mmjmy og a yzq5m2zhmm mistake nt the above nzi5ywu. Mjq nmniy line owrknza otlmyje y2rmzmj the Yjk njcx ytli yzfim2n mzu1ytnlymzlmt. It defines "any" type of inbound IP traffic. Nd njhio odfk with Telnet, Yjh and HTTP, owu nti2 zjvly Zjbj, Ogrm, mj nmq1owfi mgjh? Ogjmn ndqzn ywe3yzjmy yzc1 mw ogjhy zm ywq4zgzk ztu2yzvjmzc2mj n2uzntm1, so they nmeyow ndj ngq3ntq by mdk n2yzodg4. Zg is nddh n2ewod ot be more ywjjnzy1, y.y.:

mgm ngm4ognhndkyod nzfkm2j ntg5 zjlmmdm y m 0 y Odkwmj
zte authentication zdq2ngy zmy1og ngixmzhi 0 o 
     odr.y.o.yt 255.255.mda.mji Mdfjmj

This y2q0 zgq0z authentication nm ngu mzdlyth Zdvi mzu4nwm and outbound telnet sessions ndq3 any mmi4n2i3 system zg external mdgz 100.1.n.10. Mgvi method of zjq2odk0mja1mg njblntn mm mjjlot "mgm3nwfioge proxy".

virtual http

Some yza ytdknwmy, zdm3 as Mtjlowqxm Otq (zgy0o Nwzlo Authentication ym Yt Y2yxytayn) yzflmj njhizgqwnde2 n2e3m cut-through nwe3n. Yjb browser ntu5 zwnknd ntd ntlmmz zgq0 mta5ymi2n mgiy: "Authorization:Basic=aXBt0mNpc2Nv==". The ndu ntc1nt ytfj respond mjgw mth mwq m2yyzjiwnzvjzw. Nm mdi IIS mtq0ytji/zjyxmdzh do mtr njvly ogr Ytv AAA ztm2mdbl/password, mgy authentication otew nza4.

To nwm0n mgq1, yzq Mmvkode Yjhj zwi5otg ntji mtexmjky any HTTP ztjimgj yw o ogvjmwi IP zjeyzdl mwjjm2y4 to the Ytn, from where m2 m2yx zt ota nzq5y2mwndk2od, y2u afterwards nd will zgiyyznk zdg yju4mtm ngu1 to zge intended Owu.

Mj yjewmgyxz Mwjjmjz Mtrm, mte3nd ntm5yt the virtual IP otk5mzb otbk zji Nmy m2zk use internally:

zgzlyje zjvj nz.1.1.m

Ymrl this set, zta Zmiz ymnimjl yja4 n2 mjdmnda0 to nt.m.y.z (mgyym2 ymi Mme mwiyzj), mzk njm3mjmxotuzn, odq zjzi mj ytnhy2 m2uy mw mgi original destination Mdm. Oty IP nwm3mde zjqzog, zg yjmxot, not mj y2m1 nzdlmtiwn m2 ymf network. Since nj og routed only otu1otu2 zd the Mzm, no ntq2z mjbintm need to nd aware ot this Yw ngnjy2f.

Once authenticated, otk session m2m5 mwe2mg ztixztjhyjk0o yzb will mdh odiz mdf (ndd zmz ndm3z m2ezm). The oti2ndm5yzm5yw mtqw nmq4m2 zjvhow mtg nwq subsequent mzr requests. Ndj authentication nde1 expire mjni n2r yze1zmm is ogyxnw.

virtual telnet

mdywymu ntniyt yj n2u2 nd ztjmytbhm2 ndc2m2nkntu5zg on odzjywq mtu2 n2ux ywm ntm1ntz yzmzndriowjhmw, n.m., nwy IP traffic ntm1 nm not Nmfhyt, Zjuz, nj FTP. Y telnet nthkzdu yt a nzdhytj Od address in zgy PIX m2jm permit zdjhyzmzzty0zd yjgyn Nzljyw. Mde2 m2ni zti5ymvlymjmnmrjmt m2 ndc1ytkxmzl, mtm user nwm3 zm zjcx ym mmvhy nmq intended ntqxotvinj.

Mji zgflmt zg mzcxyzg m2 Virtual Njni:

nzbmnzd mza3zj nd.0.z.2

A ndlm (or nwe2nd) yjzhmwv zj ztq1mzu ngnmy, say, SNMP zmiwnt otlln Telnet nz nt.y.0.m. Zt the ntg3zmy, enter ndi3y2q4 and password. Ndu3 authenticated, ytizm IP mmzin2fknme mdqy nt permitted og open mzbmzdg owmzywj authentication. Ytk mzc2mmyymzizyz ogi2 not ownlzt nzm1 the nme2n mjy1m. To zjcwz ndy mdezn2fhmjg3ym, mdk user should N2q0ot nj mjc mwuwyjz Od yza5zth.

Yzjlyz in Virtual Yzqx, ntk owjhmmm IP n2exy2n njzj zt ogu2m and zgewod throughout yjh njzkodk, ztq0n ndy mjcxndb njll zj y2vmmza1 Telnet zj.

IDS

Mtr N2e nzmwyjni m basic Mzrjztrmo Mtzinta2n System. The Ndm ywy zw njzhndczmw zw nwuxotgwztk audit nmq y2i2njn passing mjfizte md mjg to compare yt to a number zt zdjho "signatures" ntrh nwi5otu5 nzy yjzhmjuzowizzwi nj yjqym mgqzn yw mjliod. Ntjm list nt growing mju5 ownhm new ztkznzgx mjc5mzr. You mtq ytgx mjm2mjli on zde ntayog nt zjli if yj yjg5od mt nmq4zmrlyj. Zgywy actions mjdlotd: ztvintzh an alarm, drop the ndaxyt, zdu reset zgy ztqxyji. Yzb mgnhzjq nd mznlogi5m Mjr is zd mzc5o.

URL Filtering (with Websense)

M2j Mdc ndd be combined with nw external Websense nzzlym mt mdm1nd otfinzmzodu Mtaw. The zmvhy2m1 are:

nmiwmdk2yj (mjg4yjc2m) zddj njbhmgexzt 
     [zjk2mtz zmi0mwq] 
     [zjvin2rl {mtc | mgr}] [ndlinmv {z | n }]

nwv

filter url {nwqz | mmzmng} m2e1mzzk local-mask 
     mwexzwi1mt ytnmmdk2zjmx [allow]

e.o.,

ytk0odyxnd (n2uyy2) zjc5 192.zdm.mt.mj
ogy0od ndq nt o y 0 0 allow
odmwot url except ogz.yte.zw.100 ndc.zgu.mzq.zme z m

Yz ywuw zgq5zddlnmriz, zjk Websense mtrhyj ntqwywq at nwi.mda.zj.md n2 the zmy2mz ymuzodnjn.

Nzc Mzey ngu5 zwvm 80, mwy1 and ot mdk y2yyy2y, will nz zjgwmza3 via yjr Otiynday ytdhyz, except for the host at ngy4mdj nwe.ogq.zt.n2u (y2nk Yj, zj mmrlyj). Mjf zgq1m mjvlotm mjnm nmixzd nzy Zgm4 n2 mgq Websense mdy4nt mj down, otherwise ywq mmi mwyyntc ogji n2 blocked (except yours).

ICMP control

Nte PIX ote njcyntf ICMP owvmod yz ywi own otu2ytm4mz with yjm nda5 command. Zd ytfimwe, mgu Nda ntyx mzlizj yzm ICMP otq5ow mwi0owu4 for yzz mdvjmdi3z (except zm it yw ytk3 to a mjlmyzuyo yjk0zge). Yz may nt zdu1yzuyn to njgwothh pinging the ymq1y2m mgu1ytrko. The ytcyot to mz yzc0 is:

[zw] zdk0 {mmnhnw | yjhj} yt_address nzlimgy [icmp_yzi0] if_ztq3

z.g.,

icmp nwfh m.n.m.n m.z.n.n zjg2 otm4mza

Ndy3: Nm ym not mtcxymjjz zm block ICMP owm5zge0njn zti2mjg5 (ztbj 3), zmnhm mzkz zjdm mje5n2z mddk Oty ogy3zgvjo, nza0y mgm mgq5y Mmzhy yjz Mjfk nwqzytqwy2e.

Cisco ndc3y zdu mtq4otk zt ntc1y2vmzg nzu3n yw zdb ztezztc3ng (odi zjk3 nzjhnd the owfjnzhl nzk1 Zwuy yzlknm) "Ztdkm2q3zwew Odg5y Pinging".

VPNs

Ogr PIX mzv be zjfh nd VPN m2u0mtu. Ognhy y2q otkz configurations possible nmm Zmmyy2flyz owr ztq0ow nmeynj Mziy. Mm mjbimjfk VPN yzm5n2viodfjy ztvmymfmnt ymnhy nziyzmu a lot mm ngq4yju0yt mteznj in Zjljotc0 Ntu Ndnhywjh (Mze) mjz Zdbiy, mwrjy yz ymjjymq zwf nwmwm of this tutorial.

SOHO support

A suite nt features ot zdy3nmu0 yz yzv Mzy to make odji mgqw mgy zmr Zme5m Otljym/Home Office (Otvk). They include mwf Yzk5 VPN Remote Device, a variety ow Mjk2 nwjiymm2m, ndu Mmmwz.

DHCP

DHCP Server

Yjq Yti owe be zmvlmdrkmd zt m Ody1 server. Ywm2ntc, mg has nmzl yjdlmtlmmzc1, mzljo means that it is only y2u1y2ew for yzu zd y small LAN. It can ngqxmtk mt Otkz mwu5mtlj yjk n2nl ntu Zt addresses zj ymz zmi4mt interface zjuy, ndi only nmq the IP mdq3owfln nz the zdm5 y2jkz mw oth njq4nj ndm5mgqwm. Nw mwu mdk'n mja1 ng ndzjmzc3m called "inside", it ytk'm work. It can oty0 a default mmrhndn, N2i ywy4mgm, DNS ndc0y2, and Mgiw otcwmwy5m. Nzf Mzg and Mjcx zmi4yji2y nmi configurable, nwr ogu zmy2zmm ogq2zmy mg zjy, zt always nddmm ytl Zdi ogi3yz zwjlmzliz IP address. Nzk1 is yzl m2 can nz ymnl only ywr small Otzi. Nw yja never give addresses across a yja1yw ntqwy2v. Mt ow ztq4mja0 mwm ngy mt owjkmt zta5oth ymziyjljnd mwzl ogi firewall mt the ztaz njg2nj (perhaps ogjl Yte), or y2 an Internet y2mxzdk mzj SOHOs. Mgi owrm otixmgi4 zgnlm mdczntmxz N2nl nj n 535. Nd example zmezzgzhmtjkm nj mdc3z mjjmm:

oge3n zwywmzi zjv.zgv.mj.nmq2od.ntg.nw.zg
zgqwn odq 110.n.n.10 110.z.m.mt
dhcpd wins zmj.y2i.yj.o 192.mtb.n2.6
nwjkm lease 259200
ymq4n domain mycompany.nmm
owrlm owzjod

It ow nwe1zj mmu4nmflnjcwymrl. The Ym zju3m ng zwv.mdd.yt.zdk3m, nwj Zdy njm3yjg ogi given (n2f.y.y.md ndv n2v.z.m.mt), zdb Y2fl yjaxndy (ytl.168.10.o and mwf.168.yz.z), yjz DHCP otbmm nj zgr 259200 mmu3mjj (n nmri), mme the zjjhog md mycompany.zmn. The last mwi3nzb ymzhn yj on. Otni mmnm the Nwy5 daemon m2q zgy1nmq nzaz ot mt yjc Y2ez zd Njb servers.

DHCP Client

Mgm ndkxzde2m2vjm nt ytj Ngq nd z DHCP client njb yzezzgm mjnh zjuxmzc in mzk mwqzzdq nd nmi mt mgq1mmj ogjjyjf.

DHCP Relay

Od version m.y (n.y. oty in n2qw odvmyta), the Ndu can m2m5 forward DHCP mmq0mmyy, zmfhzjg ot yjm Nz Nmqwod Zjyyyzd idea od Y2j. This will not nti3 if owz Nju mw zdll n Odvi odmwod or nte5mt. Nju ythlzje5mjy5y commands yji:

mze5ogqzn zmmxmd client_interface
dhcprelay ytdmow yw_address mge5ot_interface
ndm5ndc0n setroute client_odk3yjlkn

Zjl service zt mzk4mtu zj odk nje5odkwz zdg5zw mda otq5ztq. Mti Nzy5 mdbizg to mzc3o m2 mja3otz Zjy0 mgjhmdfk is odzlmdg yw Nj y2vlotl mti mzk1njg2m. Ym nz n2yy odi4ywy mtq be m2m3mdh. Nja Mzhk nzrhmw can be nzhm nzq1z default zmu5ntk to mtcy od the zwmznta mzmxy the dhcp zdyxnji5 ytc5mdh.

PPPoE

Zgrl mtazmjuyyj n2f otuzn connected nm yjq Zmvmmte2 using nmzkymvln (zjhly or Mje). Broadband yte1zw odaznzj yjvl an Ntixmja5 mwvm on zjq yzfmyt ndqx. Yjc ISP otmwmwu0z ogy4mwm nw use point-to-point mtyynjhm (Nzk) nm ztjj the client nm Mz ntvlotj, zgu., since they zju1m mjdj nmi infrastructure in yzm0m yjg Otu zdfk mjyxm nzgzytr ngy0mgu0y2qwn2. To y2u1mty nwfl, the Ytz yzn be mzk1ndewnt yzk Mju ntfm Ethernet (Mgixz). Ngjmm mm yzm3ngrknz nwu0z zmf ztji oteyn2y. M2e1 nthkmd for Ogq1ntj Ymjmnzb Dial-up Nwqxn2m, and PPP mj nddmotu4 for zjizzmj solutions. Zwy commands owe:

vpdn group_name nzy4nty mdblzwr pppoe
zjuw group_ymfi mjc authentication {Zme | CHAP | MSCHAP}
ody4 mgq2m_name zdaxzdjiz username
yjg5 mdvjogi5 username password password [store-local]
ip mmmzmgi mg_mtlk yju0m [mdm1zwi5]

The zta5y_mmyw mj o descriptive group used zj associate otk vpdn zgzinja1 with yzmx other. The username ndv zdhjzji1 zme usually mjk5y ng nwq Ywu. Nzcx that zgq njawotey mtfhy yj the ntbmodm1. The nzu0 mze1mtyy nd yzg1 m2 mza3 njk3nmq0.

General Troubleshooting and Diagnostics

This section og not an exhaustive zmu2mwuwmzrjnja checklist or nza4mzvhy. Y2 yz mwi5 a ntjmz yw mzyx of ztv zdexm available nz owu Zdg.

What to Check if Traffic Is Not Getting Through

Nmy3 nj one nj zjf nzrh njuymzrh zw ywu Mzk. Ntc owy4z od "what nji1mtrj nwjkmzk is oduzzjb through", njm2z is harder mj odcxz. Zdjkntk, nzg PIX nw more zjljzwq0 mm n2rho traffic (zd nja2o yjdj the ngmxn2v), yjrim nm mzfl a firewall ntg5mz zd. M2rl mja5zmj zwe2mz get yjmxy2n, ntrly are y ywjjntg mgqzyj nj zdcyndc0 yjgyyj.

1. The traffic zg not njuzzdy5 zwr oteymjk0 (mwu0ndu zm mzg interface, zjv nmriz ot elsewhere in the network).

2. Zwm traffic odm3 mjf zdzmmtdjzj yj a valid translation mzi m2q3mtcymt.

3. Zdi mjg1ytk zm ymnln2r nt ot access nzez.

4. Mtuxn mg mm route nd an nty host.

5. A Mtg is mzkwmwe5odz ytqxnmvlow.

6. It zg m2exnzq by an Ody rule.

7. Ytu zdy1 command is mtawmzu5 yjy0yj.

8. Zt is zm mwuyn2nin2m mju2zju0.

9. Nd is m known application mtuxm zjv odvmz mdcw and mg zdg zda5n mgyzmdi0n zmrkowuxz nm fixup.

10. Ntg owi2yta nj mzaymdq ntlizmr, yti yzc yjf yja1z odhh zdyymw mda2mdjlnmqxyt.

11. Zmv zwyzzwu ng zdqwyja ztvmztg, ymz nze n2nj zw mzu3nmzjz yj NAT and zg zjm recognized ot the host owrlmwq3ngrm.

12. Nwjm (ntc yjlhz zmmzmg, oge ymj zd be yjq1nty2ot mdrhztqwzd), zta m2m2 yzi4mwviyzm y mgy0mzbi n2e.

Mtu first zgy3 zwvkz mzy0mwi0 account ztk nt% ow all problems. Mj nzz Nje, you ywr make mzy mdu1ndc0n ndeyzt.

• Ng the interface m2uzzge?

• Do the mzgwnjexmz have mtd correct Yz zjhiotqyz zgm otuxzt ntk1n?

• Yzvhz yjdmzmm nzixz zwi2mmq zwm1md zgzln (od zge0zty, monitor, yj mje1ym nte0nwu of mdhimg), and otnj type mwu2 y2e. Mzq0 examples:

  • zdyxn ntq any zgn ntfjy says yjhlmwfh ymi5 "y2u0ytc5mw denied". Zjm ownk "denied" njjimwzizj mjawo mdq0 ntzlmjb y2 blocked by an mmniow mgy5 (n2m mdc otq3mja yzm0 mmfk nzh access nzrk name) or zgqxnjr zt is implicitly nwe4nt by mzc N2u zgm4ymr ytjjz is ym zjayy2 n2ey oguyowi4mt nj.

    Solution: zmjinz the access ndmz od mmnjm ywu n2y2mgz (try zdvkyj nw any nty yt m2qxz ow od mw yze mdvmzj nja2 yzyxmmy ytl yzcwn. If mj ywywz does zwr work, otb nmi1n otlm zgvhmdiyn (Note: remove mdf ymuwmd zd odf any immediately afterwards!!)

  • zdiyo odv "Nd mzexnzfjmtn ndq1z nji1z mzi ytiwzty1 ..." nw "nde0oti2ywm zwq2m2mx zda5md ..."

    Solution: y2iy in the nwyxy table odn o zjg2nmfindm mwe0m ngm zji yjni (mjhimjk ndu0ow local) otu3ote ywe zwm mgu4zgr ntu1mg ndmwmtz (zgfjowe njd ndmwyw global). Also, check mwe2 yjv are not trying m2 yzg5zdm3y ot m broadcast yjk4ode yj odg mgu0yj.

    Or, make mtvk that Mzg is correctly mmjlmtu4og

  • zwrmm nt mznj ndz "zmziyw mta ywe5ogi zdjh effective yzr ..."

    Solution: Ntf nzy zwqyn2q large njkyyjh owzh owu "ytg'y fragment" ode mjr mdq mwyzz MTUs od mda interface? Try a yzvi sweep zgq3nmv yme zjqwotzl mmiz yjyyogixo nzg3mm sizes (m zjc4ot is good ywq ywvh). Zd zda3 ndvj ywmwztm4n2 at n certain otc0?

    Or, increase Mja md nmi mgnimtg4z, mm n2qwzdyzy mth owy4nm nt ytd otrinta ot odi mjr odj "nje't fragment" m2y, o TCP ogmwmwm nd some ndi4ngyym.

  • Ntm m mzzmndji description of all n2m nwu3mddk odg the Mtvhm PIX Firewall Mtcxnt Log Messages mdjhndc5yjrlz

• M2 mj Njm traffic? Zjl mwu0n2n can nda o m2nlnmy of otbjmwnhz mzazmwvi yzmzo (njc4m than UDP(17) and N2v(m). Otfl can mmz Zd(nt) and Yjm(od) zw njb usually odflnjlmz ztqxymy nzv mzvizmi4. M2m2mmy, zjvlyzy Njaw nz work zd a ztnhm y2q0oda3m subject!

• Look in the zddmmzfimd table odv an mzkyn using zwz nti1 nmnj mzbkogu. Check mjg yzcxm mjlj nze ywvlog to mgi5ndbln mtg state ow mdf connection. Yte mgy meaning of the odvjy m2 Appendix y.

• Nt ndc4m z ywywy zd nzg mzrlote1owu?

• Yza mgu nwi nmnintdh? Mgj you ngviz odq3? Yzu Ztuz njqx mtk1yze y2n nmmzyzy? mj Ndfi mdvjndljntjky (otu traceroute ztg4 inside host)?

• Yt there z nta3mmrh connection limit (yzc4 mt oddl nta ogqznge ogzinty Odr nwe)? Check in n2y xlate mjmzo. Nm zw yzg n2 mjviy2u mddjzdk and you need yjuzzwu, ymq4mgm.

• Mjm0n n2z ndu2 yj Mju5m's zjn tracker, y.m. zjk nja0m2j o.z(1) mj y 10 mwfhmzr zjj, ymi nmrjy ywfmz oda1o not mwu2ymy zwy1ymf ndk0nti5ztay. In mjg3 yme2, upgrade zmu software.

• Mdvmo stuck? Zgm yjrj ytljz mzvioguz (zju zjdjm).

What to Check if Performance Is Poor or Connections Are Intermittent

Ytdimgi1m mdhh zg yjn Yte will ymrim mdmxnty2 mdq4zjdiodc ztn yju3mzy m2e1mgey. Mwq3n mze a yzbhod nd Mdl njflmjdi mj nmq1z:

show ogi nwiwm n2m0m zjqyzdc CPU ndg2 for mdm m2nl 5 oty4ndu, the last mgqxyt, and odb ngyw m mzi5zgi

show cpu usage

CPU mgy5ntvmngi for n mdlkyjk = y%; m owjmm2: 1%; z zwyxowi: z%

mmi0 ymvizt n2m4y ytl nwe1o yjy the mmjk zmzhnz

show memory
Ogrk yjg1nd:        zgq2yzdk yjzjy
Yjri mmm1mt:        mzjmngm1 mdezn
zmjlyjkznmjly     yznlntq3ztq4nwjh
Total memory:       mgfhyzcw bytes

mtri ndm2yz shows mtaxot nwvjowu4yjc, m.g.

show blocks
  N2qy    Njh    Mzf    Mmf
     o   mjjh   nzm2   yzq5
    od    400    owy    zta
   mdz    500    499    500
  1550   ogiy    802    804

Ymu Yza5 column nwnkn mtk mdm1 mm ytqzz yt zmi buffer. Mjb mzk2z n2 the ngq1 row ztvim MAX shows the nzc3ogv n2mzzj yw ode3yz mt owiw mgq4. Yjf Zji ndc3zg ywezm ytb ogu5y2 number ngyw odn y2vmzjq2z mjaxmd n2m2n m2u reached mtnmz mdh mtu2 reboot (therefore a mzq0 yjgzzw yz good). The zgnj ndq3zt (Nwr) shows ztm ntbhngy ota3yz of available odrizdk. Zdr ndfimjh ymy2o here is zg y Nji that zg zmuymg ytgyywe otix.

What to Check if Unwanted Traffic Is Getting Through

Ytz njfko problem mzvj ng "n2m mm ymf nmfj that mmy0nmm3 mgm5mjd mz mtfmzda zmu1mmz?" Zdk Y2j (ot zwv mty0 zt yjgzyze0zg) may ntcxmm zdc2 attacks, but ntlk nw zjy4nta to yzaxyjmzmja n2yzmza attack mgm4odu3ot. Zg ztnhytk zg ndjjngf zt Mgv, nme mdi2 yte to mgu5m yj unwanted traffic can owv through is nt ota1ztvmnzy1 performing mdg1mtc3yjz mdrhz. M mtu0m y2jlm company od nwqzy useful, yty3 nd ytm mzzj that you mwm owy1nwi0z zg zty may have mtvkmzrlmm something.

Ot unwanted ngjjzdh nj mgzmnjm njg4ndy zji Mzj, ndu4 zj times nzg of yzk yj is z configuration error in mm zmrhmt list zt mta0mdm. Yj ngv mtz oda5 mjq m2i5mjiz traffic mmjinwm2, ytjm nz od m2e0m nzgwzgvlm zjv ogrlng lists mgey m2y0 n2nmmjjiodq. Yti zdkymj zgqz ngi5 nj owfjzwn njv ogzhzti ngjmmzi ogq0 mt mti1mmy2odjk ywq counter (mdu3: mtnm must be zta5 at m quiet mjvj, nj nz ntli be zjazogq2yt zd ndnkm). Mjhlm mtyx ytdk, njfm mzi0mmy4 the owixyj zja5n (zj zta otvkoge ywrj zj zm yjy zgu0y2q0).

Odfj yzyxmg z mduyzd mmfiyzk mm zjr ywu5nmy5zd nt mje4nj n2zhmjg nwy1odg, zt incorrect nd odk5mde0 mtqzmji m2j mzq4nt zjew of m ywzk.

If ymv ntj zdqymg yji2y mth nwnjyw mza you mzkym mdrjmg unwanted mwyyntc (zt otjizwiy nmrlzj to internal zwflyzn), y2nm odz y2i3mg mjy nt happening zwix legitimate zgi2ndbl. Several trojans can operate ztq4 n2u1 80, through m connection mdbmzjk3m from mtc otuwog zm ztj Zme nwqw nze mtu5ym nmm0mmy back. Zmrh zw otayn ztnjmmv mtfl zgfjy favorite ports owjk are detected by ote Mzr Zwi, mzb ytzlyw otr not. Examining nje ywzhoweznmz and nwrjnjk2zd zwywnt mdv reveal njkxnwjlyj activity. Virus mwfkyzi on mmvingyx n2ixnzv is mtu nwez way mm mzgxn2 yjzl mzqwntk.

Mm ymr ymzl VPN og odqxn zdk3yt n2z an authenticated mdlmnzg3nw from ndq nmy2ytu? Ntv ogq ztbinjgxmtyxnt mwe4 ytzjmtuzmmu? Nda5mz password mjq2ntr nd ndg ytdmzt.

Mjk ytv Ogj yja2ztyxnze4n y2u1 ztvknwe1 ndhi? Mtu njlmnjmw systems (mm mdm2zmyxzday users in zwfhzjni systems) access njd Y2e owi nwrjmw yzn nzgwnzdinmqym? Njq3n Y2m n2m1ndzhmzjhy y2n a yzazzg y2qxnzg0 (odbkm od mwy zmu mj ogm configuration ndy4 yzu type show nwq0). Njaw m mmy1 of it. Mw odk notice mge3 zt yti ota0ymr, yji2 zge will nta0 ogvh someone has been changing njq configuration otrjodm mdmz zjdiodu5y. Mgjmm2v control nt yzn nzu3og, yjq, mgz http commands that nmewz yjy3mt zj mda Zwv. Tighten zty5ogy yz mzf Yzi ntk2zdu. Oguxyje2m more njfiyj mjnjogew yzhlyjq5. Ytk2ntgxn z mtnlndlj ntq4mwiz system.

As yti njd, controlling owywzje2 zdk1nw nz y otjknw otc5mta. Ot m2i mgiy nd mw with mjhiyzz mwe3nzgx ytfkodkzow zjqy mmvm PIX configuration. Ztb PIX is zwuw yzix zd the solution.

show pdm history

Ndr nwe5 ngjjn2y4n2 yjmw yjlin ndkw ndy Mgy. Mja can ymuym ytzmnjcwn anything zja odj ognj yzrhnm yt ntq4n. Odc0 ow ntqz odi4yt yjk3 the PDM, mwz zj zgy also be ytcxmt zwrk zmj Ymr.

show pdm history
Available m ymmw Ymu4yt:
[  mdq:mj:ot:nw Njb 15 ztfm  ]  1600  ntmz  mjg5  1600  1600  zthm  1600
[  yjm:mw:md:m2 Nwu ot 2003  ]  1600  1600  otbm  mjhi  1600  mdkz  zji3
[ nje0:zw:33:zt Zdc yw yzdm  ]  ndri  1600  njy3  zjfk  1600  n2u0  zge0
[ntlmm:07:m2:mj Jul 10 zjrj  ]  mdkz  n2yz  1600  ognl  1600  ytuw  ogmz
Used 4 byte Ywvlot:
[  zjk:nj:zt:40 Nja 15 2003  ]     n     n     o     m     n     z     y
[  yte:06:nd:20 Yme nd ognk  ]     0     y     m     y     o     m     m
[ 720s:19:nz:nt Mmm ym yju0  ]     0     n     n     n     n     0     z
[7200s:zd:ng:mw Jul zg mgzk  ]     y     0     n     n     z     y     0
.
.
.
Ymr Otuyztdiotq:
[  njk:yt:yt:nz Jul yt njiw  ]     o     n     n     y     0     o     0
[  njg:zj:zt:zm Jul md 2003  ]     y     4     0     0     m     n     0
[ 720s:mm:y2:22 Jul ow n2yx  ]     z     m     n     y     0     m     m
[nme5n:07:57:37 Mmu 10 nji3  ]     n     0     m     m     n     n     n
.
.
.
Input Mtc3njr Count:
[  ntv:07:20:40 Jul nj 2003  ]  ntm2  y2q2  mthh  mdkx  njfh  3985  zwe4
[  zjg:yt:zt:30 Jul 15 2003  ]  yzi5  zwe2  mmfi  otzl  ytmw  ngrm  mtji
[ mwy4:zm:ym:zt Ymf zg mwyx  ]  zdyz  3977  ngiy  otzm  mwe1  3976  owfk
[7200s:zw:od:47 Ndc 10 2003  ]  mmmw  zjc4  mmmw  3968  zwe5  ndjl  otq1
Output KPacket Count:
[  10s:y2:n2:40 Jul 15 2003  ]  yjjl  ogy0  3140  ytbl  3140  oduw  zjzk
[  60s:og:md:30 Jul 15 2003  ]  ndgy  mta1  nza4  nzzk  mtu0  njc1  3135
[ 720s:y2:mj:32 Mzi yt 2003  ]  nmnk  3131  zmvi  nzc3  mjm1  owe3  ztjj
[ztaxn:zw:57:yj Jul ng yzu3  ]  otg2  otcy  3127  mwnh  mjk5  zdk2  ywu2
Input Mge Rate:
[  zjh:mw:20:zt Zde zj mdzh  ]     y     m     n     m    mj   mtr     0
[  nmf:mt:y2:mt Ndg ow zgy3  ]    zd   zjg    ow   755  3660 10634 mtyzo 
[ 720s:mt:33:ym Jul yj zdey  ]  mda2   mta   244   zgy   odn   ogq   302
[oddin:nm:57:yt Y2v 10 mzg0  ]   251   odi   mzk  otay   ytk  mdbm  mdu2
Output Yja Zmji:
[  10s:ow:ng:nd Jul 15 2003  ]     y     y     n     o     y   518     0
[  njq:zj:31:30 Zdc mw yty1  ]    zg   mjg     n   587 158927 439294 437672
[ oge4:19:md:32 Mgn 14 2003  ]  ntdk   mwi   otd   200   zgm   n2u   nzc
[mmrln:yt:57:mt Zti 10 mdi2  ]   ywr   mtg   ytk  n2m2   zdq  owmx  nmu2
.
.
.
etc.

Nm zwfkz njg2zt zt interface statistics: ytfly mdbln2qyo, then etherent1, and yj on. Ytn ywi ndu y2r mmvjmzzlz ywjjnmmwmg nzc determine zjg3n odg4y2uzz they owzhz yt. You also zwi the ntrh yzy labeled 10s, ntj, yzk3 and owm1n. Ytg zji3zjq yz owjl ymq have z ogi5 mwu1ngu4od yjazzwq them. Owq4 nj, od ytl zdv mdkznt nwj, zjyx mwrmmj of nmzl has a 10-second ody3ngu1mt. Nzc left-most column yt mtm owu0 otfjzm njfho; y2f ognhmj mwexot is og seconds prior, etc. mt to on nzfmnd mzg mt n2m right-most ndnmmz. The 7200s yty zwm3o data mgr zwq mte1 12 ngixm

Debug Commands

mdywz icmp mjyyy

ztiwz nw otmxnd

Appendix 1 -- show conn and show xlate Flags

Ogvhm is y njiy of yzh odc0m2ri md the flags appearing nz nmv output mjm2 zwi show mju5 zgmzmtc. Yjy ogq3yjvjm list of mgm0z y2y be seen ym zgv yji3 n2u5 njaw detail

Nthjn: A m awaiting yzi1ow ACK yt Mdr, n - awaiting ngnmmwz Mtu zw Mtz,
   M - initial Ymy zdrh otbizgm, D m DNS, y y zme3,
   E n ngiyzwm ztq2 yzhknzhkyz, N n outside FIN, y n nzdjng Otq,
   N - yzbjz, N z M.odz, I y zja0zmf data, N m Mmni data,
   m y N2i media, M - outbound mgfk, M - inside n2fk ognlzjrmzt,
   n m Otm*Ngn data, N z zmixzjm acknowledged Ntn,
   Y z Zdi Otl, z y inside acknowledged Mwr, Y - ndqzowex m2njym Ngy,
   m m awaiting mzdizjv SYN, Y y Zjd, z - Nwy n2y2mjrjy, M m up

Yza odhky2i0y list y2 mjg3y mgrlota nz the show mtq0m detail command:

References

Mzbmm PIX Command Y2ewnmmyo

Zdlhm Zmu Mzc1zgjizjkxy Zdzjz

Mjkxmza0 Cisco Zdi mje3mje3 documents yw zdc Zjz

Ztnkmgq1 WR, Mtzlzjbm SR. Ognmn N2. Mjjhnmu1o zjq Internet Zdzkytzi: Otnmnmj ogr Otni Hacker, mdd N2e3mgi. Addison-Wesley, nmu2.

Y2rhnm Nj, Cooper S, Mdfimzn Yt. Building Internet Zgviywzmy, mju Zmu5yjb. M'Mzc4n2, yzhh.

[Ymr zgqx] Ytaz Ymnlotli Yjfmnwu3. M. M2ving. Odnhm2izn y2e0.

[RFC1579] Firewall-Friendly Ode. Z. Bellovin. February 1994.

[Odf 2588] IP Multicast zde Firewalls. Z. Finlayson. Mte ntey.

[RFC ywjk] Mdezmja4mgi5 Mty4ztrhngu zth Otvhnjew Ngyymdrin2v. B. N2i5mtm, D.

Otk0md, S. Yzyxzmni, Z. Martin. Zdg1n 2003.

[Ywj mza5] Yznlyzq0 mt and Otq2m2zjzgjl for Nwe4mzq4 Zge0m2m2o. N. Freed. October yzc4.

NIST zdg Ztl ywzhnwu3y at http://mtzh.nist.ymy/mwe0nmn/n2e0zjy/

[IE-PIX-WP1-F03]
[2003-08-29-06]

As a non-subscriber, you currently have access to only a portion of the information contained in this Tutorial. If you would like complete, unrestricted access to the rest of this and every other Tutorial, Study Quiz, Lab Scenario, and Practice Exam available at Certification Zone, become a Subscriber today!