Pix 501Telnet Access From Wan Side

ufuk-guler — Mon, 11 Mar 2019 09:57:41 GMT

I want to access my pix firewall from internet with telnet . In front of my pix i have a modem.Modem has 192.168.2.1 and my pix wan interface has 192.168.2.2.I made port forwarding from my modem to pix for port 23 but it doesn't work.Here is my running-config. Thank for help.

Building configuration...

: Saved

PIX Version 6.3(5)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxx

passwd xxx

hostname DesatDenizli

domain-name desat.com

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list inside_access_in permit tcp any any eq pop3

access-list inside_access_in permit tcp any any eq smtp

access-list inside_access_in permit tcp any any eq 3389

access-list inside_access_in permit tcp any any eq 9080

access-list inside_access_in permit tcp any any eq https

access-list inside_access_in permit udp any any eq 110

access-list inside_access_in permit udp any any eq 25

access-list inside_access_in permit udp any any eq 3389

access-list inside_access_in permit udp any any eq 9080

access-list inside_access_in permit udp any any eq 443

access-list inside_access_in permit ip host 192.168.1.11 any

access-list inside_access_in permit ip host 192.168.1.15 any

access-list inside_access_in permit ip host 192.168.1.17 any

access-list inside_access_in permit ip host 192.168.1.18 any

access-list inside_access_in permit ip host 192.168.1.20 any

access-list inside_access_in permit ip host 192.168.1.21 any

access-list inside_access_in permit ip host 192.168.1.22 any

access-list inside_access_in permit ip host 192.168.1.24 any

access-list inside_access_in permit ip host 192.168.1.26 any

access-list inside_access_in permit ip host 192.168.1.27 any

access-list inside_access_in permit ip host 192.168.1.29 any

pager lines 24

mtu outside 1500

mtu inside 1500

ip address outside 192.168.2.2 255.255.255.0

ip address inside 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location 192.168.1.22 255.255.255.255 inside

pdm history enable

arp timeout 14400

global (outside) 10 interface

access-group inside_access_in in interface inside

route outside 0.0.0.0 0.0.0.x.x.2.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout sip-disconnect 0:02:00 sip-invite 0:03:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

http server enable

http 192.168.1.22 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community netvizyon

no snmp-server enable traps

floodguard enable

telnet 0.0.0.0 0.0.0.0 outside

telnet 0.0.0.0 0.0.0.0 inside

telnet timeout 5

ssh timeout 5

management-access inside

console timeout 0

dhcpd address 192.168.1.10-192.168.1.100 inside

dhcpd dns 213.243.1.40 213.243.1.42

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd enable inside

terminal width 80

Cryptochecksum:xxx

: end

[OK]

Re: Pix 501Telnet Access From Wan Side

1cmerchant — Mon, 09 Apr 2007 13:59:47 GMT

I believe that in order for the Pix 501 to allow a telnet session to the Outside interface, that the traffic be IPSEC protected.

From the Pix 6.3 command reference guide, p404: "The telnet command lets you specify which hosts can access the PIX Firewall console with Telnet. You can enable Telnet to the PIX Firewall on all interfaces. However, the PIX Firewall enforces that all Telnet traffic to the outside interface be IPSec protected. Therefore, to enable Telnet session to the outside interface, configure IPSec on the outside interface to include IP traffic generated by the PIX Firewall and enable Telnet on the outside interface."

Since Telnet isn't secure, you might want to consider using SSH instead.

Carl

Re: Pix 501Telnet Access From Wan Side

fzamora — Tue, 10 Apr 2007 03:34:50 GMT

Is not possible unless is IPSec protected. Please check the link below:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/tz.htm#wp1025921

I recommend to use ssh instead, check the link:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/s.htm#wp1026535

Hope it helps,

Franco Zamora

topic Re: Pix 501Telnet Access From Wan Side in Network Security

Pix 501Telnet Access From Wan Side

Re: Pix 501Telnet Access From Wan Side

Re: Pix 501Telnet Access From Wan Side