Re: Is this correct for PIX Firewall.

singh · ‎03-04-2005

I like to block ip range for 64.68.96.0 with 64.68.127.255 as subnet mask at PIX 520.

conduit deny tcp host 64.68.96.0 subnet mask 64.68.127.255 0 0

I don't want to use any access list.

bhillman · ‎03-04-2005

You need to use 255.255.255.0 if you want to block the entire range of 64.68.96.0-64.68.96.255

singh · ‎03-08-2005

I tried gave me a syntax error.

As I mentioned earlier:

64.68.96.0 is the Ip range

64.68.127.255 is the subnet mask for that range.

abacco · ‎03-08-2005

64.68.127.255 is not a subnet mask. I suspect that you mean that the subnet mask is 255.255.128.0. However, when you enter it into the PIX, I suspect that you need to use the inverse mask which would be 0.0.127.255.

abacco · ‎03-08-2005

Sorry! Disregard my previous post. I re-read your original post. The mask to denote 64.68.96.0 to 64.68.127.255 the mask is 255.255.224.0. If you did need the inverse mask it would be 0.0.31.255.