topic Simplify PIX configuration changes? in Network Security

Simplify PIX configuration changes?

kirbyellis — Fri, 21 Feb 2020 08:54:36 GMT

I have recently had an application move from one server to another. Is it posibble to simply redefine the "names" statement to use the new IP address?

eg: previous statement;

name 10.1.1.1 WEB_SERVER

proposed statement;

name 192.168.1.1 WEB_SERVER

This would allow me to perform only the single config change, as the name is already associated with an object-group, and that group is associated with an existing rule.

Thanks in advance.

Cheers, Kirby.

Re: Simplify PIX configuration changes?

Fernando_Meza — Wed, 17 May 2006 23:56:14 GMT

Hi ... that will be great but unfortunately it is not possible. This is what would happend.

1.- when you type in no name 10.1.1.1 WEB_SERVER ( as you can't have a name map to 2 IP addresses at the same time ). All you entries referencing to WEB_SERVER will show up as 10.1.1.1.

2.- When you type in name 192.168.1.1 WEB_SERVER to "remap"the name .. the old references to WEB_SERVER will remain as 10.1.1.1 and only new entries will be mapped.

I suggest you to :

1.- type in show run | inc WEB_SERVER and copy the output to notepad.

2.- Rename the map accordingly

3.- Find/Replace WEB_SERVER by 192.168.1.1 from the output on point 1.

4.- You can apply the new config accrodingly by copying and pasting

5.- Remove any reference to 10.1.1.1

No nice .. but it is the only way ...

I hope it helps ... please rate it if it does !!!

Re: Simplify PIX configuration changes?

kirbyellis — Fri, 19 May 2006 02:16:13 GMT

What if I first remove the mapping of

object-group network SERVERS

no network-object host WEB_SERVER

and then re-define the IP address of WEB_SERVER from:

name 10.1.1.1 WEB_SERVER

name 192.168.1.1 WEB_SERVER

I know that this is one more step than I originally intended, but I think it should still work.

Whadyareckon?

Re: Simplify PIX configuration changes?

Fernando_Meza — Fri, 19 May 2006 03:47:48 GMT

hi .. wait .. are you referencing the WEB_SERVER on the access-list by using the object-group SERVERS. Because if that is the case then yes .. you are correct .. I thought your access-list was referencing your server by its host name WEB_SERVER ..