[fw-wiz] Re: PIX 520 - Converting conduits to access-lists

From: Jean Caron (caronj@norac.net)
Date: 10/23/02 

From: "Jean Caron" <caronj@norac.net>
To: Eye Am <eyeam@optonline.net>
Date: Wed Oct 23 09:01:01 2002

See below...

Eye Am writes:

<snip>
> Old conduits:
>
>
>
> conduit permit tcp host my.public.addy.here eq ftp any
>
> conduit permit tcp host my.public.addy.here eq domain any
>
> conduit permit udp host my.public.addy.here eq domain any
>
> conduit permit tcp host my.public.addy.here eq ftp-data any
>
>
>
> So I made the following access-lists/groups
>
>
>
>
>
> access-list DMZ_IN permit tcp any host my.public.addy.here eq ftp (hitcnt=0)
>
> access-list DMZ_IN permit tcp any host my.public.addy.here eq ftp-data
> (hitcnt=0)
>
> access-list DMZ_IN permit udp any host my.public.addy.here eq domain
> (hitcnt=0)
>
> access-list DMZ_IN permit tcp any host my.public.addy.here eq domain
> (hitcnt=0)
>
> access-group DMZ_IN in interface DMZ
<snip>
try changing the syntax to something like this;
access-list DMZ_IN permit tcp host my.public.addy.here any eq ftp

Jean

Relevant Pages

  • problem with HTML traffic on pix 6.3.4
    ... If I pull the same file with FTP its fast and stays fast. ... fixup protocol dns maximum-length 512 ... conduit permit tcp host 1.2.36.10 eq domain any ...
    (comp.dcom.sys.cisco)
  • Pix 515 VLAN NAT0 issues
    ... plus get bad ftp performance with it. ... conduit permit tcp host 72.29.91.84 eq https any ...
    (comp.dcom.sys.cisco)
  • Re: Pix Config Question
    ... You probably want to go to PIX version 6.2 and I would enable the IDS ... > On my production website I have a Pix 515-UR with 6 interfaces. ... > conduit permit tcp host 100.100.100.180 eq 3389 any ...
    (comp.security.firewalls)
  • Pix Config Question
    ... On my production website I have a Pix 515-UR with 6 interfaces. ... static 100.100.100.180 10.50.1.251 netmask ... conduit permit tcp host 100.100.100.180 eq 3389 any ...
    (comp.security.firewalls)
  • Pix 520 Help
    ... no logging console ... conduit permit tcp host 0.1.2.209 eq domain any ... conduit permit udp host 0.1.2.209 eq domain any ...
    (comp.security.firewalls)