openning PIX connections

[jcowtan]

We are installing a PIX to isolate a network. Initially, we want to allow and monitor all traffic to pass either way. This will allow us to build thee rule set to be applied later.

What is the easiest way to open the PIX up and act only as a router while we monitor traffic?

[michelcaissie]

1- You can do a

static (inside,outside) [inside subnet] [inside subnet] netmask 255.x.x.x 0 0

to make your inside visible to the outside

2- permit anything

access-list fullin permit ip any any

access-list fullin permit icmp any any

access-group fullin in interface inside

access-list fullout permit ip any any

access-list fullout permit icmp any any

access-group fullout in interface outside

3-sh conn

will show you the active connections

4-or you can capture the traffic

access-list capaclin permit ip any any

capture capin access-list capaclin interface inside

sh capture capin

(no capture capin)

access-list capaclout permit ip any any

capture capout access-list capaclout interface outside

sh capture capout

(no capture capout)