topic Re: PIX Conduit vs Access-lists in Network Security

PIX Conduit vs Access-lists

ty.masse — Fri, 21 Feb 2020 06:41:46 GMT

On the old PIXes such as the classic, you have static and conduit commands to open ports to the outside. I know on the new versions, you can use access lists paired with static commands to open ports. You can also use conduits. I have two questions.

1. If you are using numbered access-lists wouldn't you be limited from 100-199 access lists?

2. Which way is better? Seems to me that conduit reduces complexity since you don't have to apply it to an interface. It knows what to do based on your static.

Thanks.

Re: PIX Conduit vs Access-lists

mostiguy — Wed, 16 Apr 2003 17:25:20 GMT

Conduits are said to be on their way out in future version of pixos, using ACLs is recommended to future proof your configuration.

ACLs also reduces training time, as they are highly similar to those used by IOS (IOS differs by using inverse subnet masks)

Re: PIX Conduit vs Access-lists

ty.masse — Wed, 16 Apr 2003 18:36:54 GMT

How about the 100-199 extended ACL limitation?

Re: PIX Conduit vs Access-lists

rj.remien — Wed, 16 Apr 2003 19:46:13 GMT

I believe you are thinking in terms of conduits which are not applied to interfaces. ACL's are applied to interfaces. You use the access-group command to apply an ACL to an interface. You allow all your access inbound from your ouside interface with one ACL. The same with your outbound access from your inside interface. As an example:

Access-list 101 permit tcp any host 192.168.1.1 eq ftp

Access-list 101 permit tcp any host 192.168.1.2 eq www

access-group 101 in interface outside

Access-list 102 permit tcp 192.168.10.0 255.255.255.0 any eq www

Access-list 102 permit tcp 192.168.10.0 255.255.255.0 any eq ftp

access-group 102 in interface inside

You can have as many ports open between interfaces, they just are all in one access-list that is applied to an interface vs separate conduits that are not applied to interfaces.

HTH

Re: PIX Conduit vs Access-lists

richardmcmahon — Thu, 17 Apr 2003 10:04:48 GMT

Also you do not have to use numbers for your access lists you can use anything. You should not mix conduits and access lists on the same system. Access list can also be run in turbo mode for much faster performance on PIX's that support that function ie anything but a 501.