topic Re: Enabling https correctly for a Cisco PIX 506E in Network Security

Enabling https correctly for a Cisco PIX 506E

bashan121 — Mon, 11 Mar 2019 15:37:22 GMT

Hi!

I'm not sure I ran the correct acl permit statements to enable https on the Cisco PIX 506E. I'm testing a proxy server which is connected to the Cisco PIX 506E. From a browser, I'm able to successfully view web pages, however, for all https protocols, its being refused. Are the ff two lines enough to open https traffic?

access-list acl-in permit tcp host 10.10.10.2 any eq 443

access-list acl-in permit udp host 10.10.10.2 any eq 443

Thanks much and appreciate any advice you could provide a newbie on PIX.

Regards,

Fidel

Re: Enabling https correctly for a Cisco PIX 506E

John Blakley — Fri, 29 May 2009 12:36:56 GMT

If this is acl is applied on the inside interface, and you're allowing the host 10.10.10.2 out, then it should be enough. Do you have the same lines for port 80? You could try to allow all out port 443 and see if that fixes the issue as a test, and then narrow it down from there. I'm assuming that 10.10.10.2 is your proxy server?

HTH,

John

Re: Enabling https correctly for a Cisco PIX 506E

bashan121 — Mon, 01 Jun 2009 00:19:24 GMT

Hi John!

Thanks for your answers. You are correct, the proxy server is 10.10.10.2 and that I'm applying it in the inside interface; I have the same line for port 80.

"You could try to allow all out port 443"

Could you please elaborate further on how you intend to do this? Which commands for example are you referring to accomplish this?

Thanks a lot and appreciate your help!

Regards,

Fidel

Re: Enabling https correctly for a Cisco PIX 506E

Alan Huseyin Kayahan — Mon, 01 Jun 2009 00:53:27 GMT

Hello Fidel,

PIX permits all traffic originated from inside interface by default, so you dont have to put any ACL statements. You dont have to enable https either, yet enabling https in PIX means you enable secure web access to PIX for administration (PDM)

Assuming that you are using Internet Explorer in internet explorer options, click connections tab>lan settings>advanced and check "Use the same proxy server for all protocols" box. If not resolved, most probably thers something wrong with your proxy server configuration

Regards