PIX pass/dropped traffic

[csanchez]

How can I view all pass/dropped traffic on the PIX firewall. I want to troubleshoot a connection problem and want to know wether the traffic is even getting to our firewall. If so, wether it is being dropped or passed. How can I enable logging and viewing of the logs.

Thanks in advance.

[Patrick Iseli]

Enable logging on the PIX:

enable

conf t

logg on

logg buff warning

show logg

Or install a syslog server on your Server or Workstation and sent syslog messages from the PIX to the syslog server:

See:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172797.html

See:

sincerely

Patrick

[klwilson]

I usually troubleshoot connection problems with Capture. Write an ACL then capture packets against the ACL.

ACCESS-LIST TEST PERMIT IP HOST A.A.A.A HOST B.B.B.B

ACCESS-LIST TEST PERMIT IP HOST B.B.B.B HOST A.A.A.A

CAPTURE TEST1 ACCESS-LIST TEST INTERFACE Outside packet-length 1500

show capture TEST1

This will verify the traffic is making it to your PIX.

The COPY CAPTURE ... PCAP will let you send the capture to a TFTP for Ethereal viewing.