topic Re: PIX Firewall 525 access list problem in Network Security

PIX Firewall 525 access list problem

marulandar — Fri, 21 Feb 2020 08:40:54 GMT

Hi.

I have teh following problem. After insert a access-list, in spite of seeing packets related to the list, these do not do " match ", that is to say, it is as if the list was not doing his work.

Which can be the cause of this behavior?

PIX Model 525

IOS 6.3(4)

Thanks.

Ramiro Marulanda Z.

Re: PIX Firewall 525 access list problem

mpalardy — Mon, 30 Jan 2006 16:01:23 GMT

What's the syslog related to this behavior?

Also you may add the following statement to your pix config

access-group acl_name in interface your_intf

Mike

Re: PIX Firewall 525 access list problem

marulandar — Tue, 31 Jan 2006 19:59:44 GMT

Ok, thanks for your help. the behavior is the following one:

this is the access list:

access-list 10 permit udp host 10.2.2.29 host 208.135.186.182 eq syslog

access-group 10 in interface inside

The packets are seen entering the interface inside and going out for the outside, but changes are not seen in the hits of the access list.

Regards,

R.@.M.

Re: PIX Firewall 525 access list problem

mpalardy — Tue, 31 Jan 2006 23:22:30 GMT

Are all the syslogs sent correctly to the remote host? In the affirmative I'd say the udp connection is never closed by the PIX. Let's say the connection never hit the timeout in the pix config. So the connection remains open and doesnot increment the hitcount for your access-list. I have a PIX that does the same behaviour.

Also the hitcount increment is based on the connection and not on every packet passing by the PIX.

You may use a debug command to see packet going thru the PIX.

HTH

Mike

Re: PIX Firewall 525 access list problem

mpalardy — Wed, 01 Feb 2006 14:09:18 GMT

In my preceeding answer I forgot telling you to use this command. To help you seeing if the connection is up between hosts:

This command "show local..." will resume the "sh conn..." and "sh xlate..." commands

sh local 10.2.2.29 detail

You may also try the "show timeout" command to see what's the timeout configured on the pix for udp connections.

Mike

Re: PIX Firewall 525 access list problem

marulandar — Wed, 01 Feb 2006 16:24:25 GMT

Hi Mike. Your help has been of great utility.

I will carry out his recommendations and I am going to observe the results.

Thanks again, and regards!

R.@.M.