topic Re: VERY basic Pix 515E question in Network Security

VERY basic Pix 515E question

_-TonyS-_ — Fri, 21 Feb 2020 07:52:32 GMT

I just pulled the thing out of the box and powered it up.

I put it on our internal network connected a laptop to the inside interface and went through the setup wizard.

I gave the outside interface a static address, added pat for the internal systems (just the above listed laptop) and all seemed well.

There appears to already be an access rule that allows all outbound traffic but I can see anything beyond the inside interface (192.168.1.1) on the laptop.

I can ping the whole world from the pix but the poor internal system sees nothing.

I am very new to Cisco and am sure I'm missing something basic.

Anyone want to help our a newbie?

Thanks!

Re: VERY basic Pix 515E question

jason.aarons — Mon, 17 Jan 2005 22:04:09 GMT

Does you laptop have a default gateway of the pix?

Does the pix have a "route 0.0.0.0 0.0.0.0" pointing to your ISP ?

Re: VERY basic Pix 515E question

_-TonyS-_ — Mon, 17 Jan 2005 23:03:02 GMT

The laptop has a default gateway set to the inside interface of the Pix (192.168.1.1).

The Pix outside interface has the following static route:

Interface name: Outside

IP Address: 0.0.0.0

Gateway IP: 192.168.0.111 (The internal interface of our live firewall)

Mask: 0.0.0.0

Metric: 1

I THINK that the same as what you're asking.

Re: VERY basic Pix 515E question

rthakker — Tue, 18 Jan 2005 00:10:34 GMT

Is your Live firewall has route configured for 192.168.1.0 network?

## Assuming you have got outside network of Test firewall 192.168.0.0/24 and inside network 192.168.1.0/24. ##

( You already mentioned that on your laptop you have got default route pointing to inside interface and Pix got default router 192.168.0.111 (The internal interface of our live firewall) but if your Live firewall is not aware of 192.168.1.0 network then it will drop the packets. )

Re: VERY basic Pix 515E question

Patrick Iseli — Tue, 18 Jan 2005 00:18:54 GMT

First things to know is:

Without an access-list on the interface a higher level interface. eg inside, can access all other lower interfaces as outside.

Second thing to know is:

ICMP is not a stateful protocol. To allow pings from the inside to the outside interface you need to create an access-list.

If you want to ping the same interface that you are physicly connected you need to configure the "icmp" command.

example:

See: Handling ICMP Pings with the PIX Firewall

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

The PIX and the traceroute Command

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800e9312.shtml

examples:

Traveroute

Microsoft:

access-group 101 in interface outside

access-list 101 permit icmp any host YourPublicIP unreachable

access-list 101 permit icmp any host YourPublicIP time-exceeded

access-list 101 permit icmp any host YourPublicIP echo-reply

UNIX:

access-group 101 in interface outside

access-list 101 permit icmp any host YourPublicIP unreachable

access-list 101 permit icmp any host YourPublicIP time-exceeded

ICMP command example

icmp deny any outside

icmp permit any echo-reply outside

icmp permit any echo-reply inside

icmp permit host 192.168.1.30 echo inside

icmp permit host 192.168.1.31 echo inside

icmp permit host 192.168.1.20 echo inside

icmp permit host 192.168.1.40 echo inside

icmp permit host 192.168.1.100 echo inside

sincerely

Patrick

Re: VERY basic Pix 515E question

rthakker — Tue, 18 Jan 2005 00:28:51 GMT

also apply this access list

icmp permit any echo outside

icmp permit any echo-reply outside

icmp permit any echo inside

icmp permit any echo-reply inside

Re: VERY basic Pix 515E question

_-TonyS-_ — Tue, 18 Jan 2005 15:01:23 GMT

Do I need to do anything to apply these access lists besides type the command at the pix(config)# prompt?

Because they don't seem to have any effect.

Re: VERY basic Pix 515E question

_-TonyS-_ — Tue, 18 Jan 2005 15:10:48 GMT

Ok, just typing the commands at the console has no effect but I'm assuming there is some way to 'apply' access lists that I'm overlooking?

Re: VERY basic Pix 515E question

Patrick Iseli — Tue, 18 Jan 2005 15:44:51 GMT

You have to be in config mode.

enable

conf t

access-list outside permit icmp any host YourPublicIP unreachable

access-list outside permit icmp any host YourPublicIP time-exceeded

access-list outside permit icmp any host YourPublicIP echo-reply

access-group outside in interface outside

icmp permit any echo-reply outside

icmp permit any echo-reply inside

icmp permit host YourPCsIP echo inside

exit

write mem

show access-list outside

Note: when you start pinging the hitcount behind the access-list is growing.

##################################################

Please Post your config, just remove your Public IP.

###################################################

sincerely

Patrick

Re: VERY basic Pix 515E question

zroth — Tue, 18 Jan 2005 15:58:55 GMT

Hi,

to apply an access-list to an interface you have to

use command access-group (ACL name) in interface (interface name)

An example : You have access-list 101

To apply it on the outside interface

you must type :

access-group 101 in int outside

What you have configured in the ACL 101 is up to you.Essentialy,for IP connection without ICMP you need not any ACL with PIX configured properly.You could try telnet connection from your laptop to the

live firewall,when it allows telnet and knows the route to the inside network 192.168.1.0/24.

If you want to ping the live firewall,then use ACL

allowing echo reply packets from live firewall.In that case I would use access-list allowing all return traffic (ICMP included)

Example :access-list 101 perm ip any any

Then try A.To ping inside PIX interface from your laptop

B.If successfull,try to ping the live firewall

Do not forget to tune ACL after the testing.

HTH

Zdenek

to the

Re: VERY basic Pix 515E question

_-TonyS-_ — Tue, 18 Jan 2005 16:50:06 GMT

pixfirewall(config)#show config

: Saved

: Written by enable_15 at 06:41:15.021 UTC Tue Jan 18 2005

PIX Version 6.3(4)

interface ethernet0 100full

interface ethernet1 auto

interface ethernet2 auto shutdown

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 intf2 security4

enable password xxxx

passwd xxxx

hostname pixfirewall

domain-name xxxxxx.com

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

pager lines 24

icmp permit any echo outside

icmp permit any echo-reply outside

icmp permit host 192.168.1.2 echo outside

icmp permit any echo insideicmp permit any echo-reply inside

icmp permit host 192.168.1.2 echo inside

mtu outside 1500

mtu inside 1500

mtu intf2 1500

ip address outside 192.168.0.107 255.255.255.0

ip address inside 192.168.1.1 255.255.255.0

no ip address intf2

ip audit info action alarm

ip audit attack action alarm

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 10 interface

nat (inside) 10 0.0.0.0 0.0.0.0 0 0

route outside 0.0.0.0 0.0.0.0 192.168.0.111 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 inside

dhcpd dns 192.168.0.250

dhcpd wins 192.168.0.250

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd domain xxxxxx.com

dhcpd auto_config outside

dhcpd enable inside

terminal width 80

Cryptochecksum:xxxx

pixfirewall(config)#

Re: VERY basic Pix 515E question

_-TonyS-_ — Tue, 18 Jan 2005 17:10:12 GMT

FYI:

I'm not sure if this changes anything but the laptop connected to the inside interface has NO access outside of the PIX firewall.

I can't ping, can't access http, ftp, smtp, snmp,smb, nothing.

I can however ping the inside interface of the pix (192.168.1.1) and can bring up the https configuration website (also 192.168.1.1).

Re: VERY basic Pix 515E question

zroth — Wed, 19 Jan 2005 09:55:54 GMT

O.K.You can ping inside PIX interface (192.168.1.1) from your laptop.

The next step : try to ping the live firewall (PIX default gateway - 192.168.0.111,I suppose).

Start icmp debug on the PIX with the command debug icmp trace

You should see outgoing ICMP packets at least.

HTH

Zdenek

Re: VERY basic Pix 515E question

_-TonyS-_ — Wed, 19 Jan 2005 14:42:11 GMT

With the ICMP trace on the pix, i see nothing when trying to ping 192.168.0.111 from the laptop. I see information when I ping 192.168.0.111 from the PIX but I was always able to ping from the PIX.

Is there some sort of trace I can turn on to see where exactly the PIX is dropping the packets coming from the laptop?

Re: VERY basic Pix 515E question

zroth — Wed, 19 Jan 2005 16:32:20 GMT

Hi,

you can watch traffic on any interface by applying

the folloving command

capture (name of capture) int (name of interface)

through the command show capt (name of capture) you

see the captured packets on that interface

Example : I want to watch traffic on inside interface

In privileged mode (#) type capture tony interface inside

then show capture tony

In this case you should see incoming ICMP echo packets from the laptop.(I do not believe they are coming,I suppose you have not the route to the network 192.168.0.0 (or just default route over 192.168.1.1 - and only one !)in your laptop).Try route print command on the laptop to check it.

ICMP commands in your configuration are not ACL commands,they only control ICMP access to the PIX

interfaces,not ICMP through PIX.

Therefore I do not think you can succesfully ping

192.168.0.111,but ICMP echo packets should leave

the PIX outside interface and the ICMP echo-reply

packets from 192.168.0.111 would be stopped at this

interface by ping return.This could be watched in

PIX log (show logg).You must start logging in configuration by

conf t

logg on

logg buff 7

You can also apply capture on outside interface !!

To achieve return of ping packets from 192.168.0.111 you have to apply an access-list on outside PIX interface .As written in previous post.

HTH

Zdenek

Re: VERY basic Pix 515E question

_-TonyS-_ — Wed, 19 Jan 2005 16:36:09 GMT

Hey, thanks everyone (especially Zdenek) for the great info.

I was able to uncover that for whatever reason the PIX was not handing out route information to the laptop on the internal interface. The following command fixed the issue:

route outside 0.0.0.0 0.0.0.0 192.168.0.111 1

Thanks Everyone!

Re: VERY basic Pix 515E question

zroth — Wed, 19 Jan 2005 17:02:30 GMT

Hi Tony,

I am glad to hear about the final success.

Just two remarks :

1.The above mentioned command route outside 0 0 192.168.0.111 has been already configured in your

PIX (at least what I see in your configuration) and

because 192.168.0.111 is in a connected network (PIX outside interface network),you actually do not need

this route for reaching 192.168.0.111.So I do not suppose this is the reason.

2.PIX is not handing out routing information in this

case (no RIP,no OSPF) and all is done statically.

But anyway,good luck

Sincerely

Zdenek

Re: VERY basic Pix 515E question

_-TonyS-_ — Wed, 19 Jan 2005 19:50:32 GMT

Really?

That is odd then.

I typed the command in the (config#) console and it didn't tell me it was already there.

And suddenly afterward it was all working.

Perhaps a glitch?

Re: VERY basic Pix 515E question

zroth — Thu, 20 Jan 2005 13:24:00 GMT

In the configuration you have sent on the Jan 18 through command sh conf is the default route written.You can check it.Of course this configuration

is the backup one,so it is quite possible that running configuration has been different.

You can check PIX valid routes by command show routes,this is taken from running config.

But anyway,I still do believe you would be able

to reach 192.168.0.111 from your laptop without defining PIX default route under three conditions :

1.The laptop is in the network 192.168.1.0/24

2.The laptop has either default route over 192.168.1.1 or route to 192.168.0.0 over 192.168.1.1

3.The live firewall 192.168.0.111 has to know the route to the network 192.168.1.0 (over 192.168.0.107)

You can try it by config command no route 0 0 192.168.0.111

check show route

Just for fun

Sincerely

Zdenek

Re: VERY basic Pix 515E question

ptaylor — Fri, 28 Jan 2005 03:45:36 GMT

I have the same issue as Tony and haven't quite figured out it out yet. Tony says that he has his live Firewall's address in the route (is that his gateway?). In my situation what is the IP I should be using in that route ?

The Outside interface of the PIX ?

Or the gateway or inside interface on my router ?

Thanks for your help

Pat