Can i trust PDM Interface?

tonny_ecmyy · ‎12-28-2004

Hi Everybody,

I'm having problem with pdm version 3.0(1),

I've entered access-list outside_access_in deny icmp any any , access-group outside_access_in in interface inside and some other commands, then i open the pdm under the access rules, it shows nothing, i think this is a bug, does it solve in new version of pdm? ;)

thanks a million

Tonny

nkhawaja · ‎12-28-2004

PDM is now well trusted. IT has evolved from several versions now. There must be something wrong you are doing, or may be some bug

thanks

Nadeem

zroth · ‎12-29-2004

I am not sure,but is not ACL outside_access_in to be

implemented at the outside interface and not (as in

this case ) at the inside interface ?

Zdenek

nkhawaja · ‎12-29-2004

i cant say unless i see your configs.

tonny_ecmyy · ‎12-29-2004

Maybe there's something wrong with my command:

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

access-list 100 permit ip host 192.168.1.9 192.168.100.0 255.255.255.0

access-list 100 permit ip host 192.168.1.2 192.168.100.0 255.255.255.0

access-list outside_access_in deny icmp any any

access-list outside_access_in deny udp any any

access-list outside_access_in deny ip any any

pager lines 24

logging on

logging monitor debugging

logging buffered debugging

icmp deny any outside

mtu outside 1500

mtu inside 1500

ip address outside 10.1.1.2 255.0.0.0

ip address inside 192.168.1.1 255.255.255.0

ip verify reverse-path interface outside

ip audit name ATTACKPOLICY attack action alarm drop

ip audit name INFORMATIONPOLICY info action alarm drop

ip audit interface outside INFORMATIONPOLICY

ip audit interface outside ATTACKPOLICY

ip audit info action alarm

ip audit attack action alarm

ip local pool vpnpool 192.168.100.1-192.168.100.254

pdm location 192.168.1.2 255.255.255.255 inside

pdm location 192.168.1.9 255.255.255.255 inside

pdm logging debugging 100

pdm history enable

arp timeout 14400

global (outside) 10 interface

nat (inside) 0 access-list 100

nat (inside) 10 0.0.0.0 0.0.0.0 0 0

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 10.1.1.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

url-server (inside) vendor websense host 192.168.1.2 timeout 5 protocol TCP vers

ion 1

filter url except 192.168.1.2 255.255.255.255 0.0.0.0 0.0.0.0

filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0

http server enable

http 192.168.1.2 255.255.255.255 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

tftp-server inside 192.168.1.2 c:\cisco

floodguard enable

sysopt connection permit-ipsec

crypto ipsec transform-set myset esp-3des esp-md5-hmac

crypto dynamic-map dynmap 10 set transform-set myset

crypto map mymap 10 ipsec-isakmp dynamic dynmap

crypto map mymap client configuration address initiate

crypto map mymap client configuration address respond

crypto map mymap client authentication LOCAL

crypto map mymap interface outside

isakmp enable outside

isakmp identity address

isakmp nat-traversal 20

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

vpngroup **** address-pool vpnpool

vpngroup **** split-tunnel 100

vpngroup **** idle-time 5400

vpngroup **** password ********

telnet 192.168.1.2 255.255.255.255 inside

telnet timeout 60

ssh timeout 5

Thanks for helping

Tonny