PIX 506E Configuration question

[ubersoldat]

Hi all,

i have never before configured a PIX firewall and i have just a simple queston. We have to install a PIX506E for one of our clients and the only thing i should do is to allow all incoming traffic (with no restrincions). That is needed for the administrators to make all changes to the PIX configuration from outside the country.

So can i do this by simply changing the security level on the ouside interface to 100 ?

thanx for your help

[jmia]

Ivo,

If you are allowing outside sys admins to access the pix, you'll be better of by giving them acces using SSH or you can configure "management-access inside" and then setup client vpn access to the pix and your remote admins can then access the PDM via the VPN and manage it.

If you need further help on this then let me know either here or at jmia@ohgroup.co.uk

Jay

[ubersoldat]

The whole idea of giving them access is that they want to create a VPN connection with us. So i'm looking for the simplest solution. There will be a ADSL modem connected to the PIX506E. If my ISP forwards SSH port (22) to my outside interface of the pix will this do the trick ?

Or can i use PDM to grant them access ?

[jmia]

OK, What sort of VPN do they need? Site-to-Site? If so what device have they got at their end, is it another pix?

Have a read of the following documents:

PIX to PIX IPSec VPN:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a0080094761.shtml

Accessing PIX via VPN/PDM:

http://www.cisco.com/en/US/products/sw/netmgtsw/ps2032/products_configuration_example09186a0080094497.shtml

PIX VPN Client Access:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008009442e.shtml

To allow access on the outside interface via SSH, you'll need to do the following:

In config mode on PIX:

> ca generate rsa key 1024

> ca save all

write to memory with: write mem

You can view you newly created keys by issuing:

> sho ca mypubkey rsa

Now you'll need to configure (in config mode) who accesses your pix:

> ssh 255.255.255.255 outside

Save with: write mem.

Your remote users will need a SSH client (use putty.exe) you can find this by searching google.

Hope this helps and please rate post if it does, if need further help then let me know.

Jay

[ubersoldat]

Thanx for your help