PIX RAS Config

[rtivnan]

I have an interface on my PIX520 assigned to my RAS dial up network. Presently, I have all ports opened up for traffic coming from that RAS interface to my inside. I need to determine which ports I need to keep open to allow my dial up users to work. Does anyone have suggestions or a config similiar to this who can help me out ?

Thanks

[bbaley]

It depends on what services they’re accessing. We have our RAS on the inside behind our PIX so we don’t have to open holes through the firewall. Depending on your topology, this may or may not work for you. In any case, determine what applications they’re using (NetBios, WINS, HTTP, Telnet, FTP, etc.) and open up the ports and protocols specifically.

[jwitherell]

I'd put a protocol analyzer in place with the RAS device, and see what traffic patterns you end up with. You'd probably be able to make some good conclusions in a few days as to what ports should be open.