Re: Cisco PIX-501 questions

From: Mike Ruskai (spamten.knilhtrae_at_begonedynnaht.net)
Date: 05/07/04 

Date: Thu, 06 May 2004 23:17:38 GMT

On Thu, 06 May 2004 11:30:32 -0400, Michael Sherman wrote:

>On Thu, 06 May 2004 09:34:54 GMT, "Mike Ruskai"
><spamten.knilhtrae@begonedynnaht.net> wrote:
>
>>One of these was installed as a firewall for a web server, and it's fallen on
>>me to administer it now.
>>
>>I've downloaded the command reference, but there's nearly nothing intuitive
>>about how this thing works. Right now there are two questions I'd most like
>>answered, which may go a ways towards answering others that come up in the
>>future.
>>
>>1) The external address is configured as xx.xx.98.250 with a netmask of
>>255.255.255.240. The actual IP addresses we have are from xx.xx.110.98 to
>>xx.xx.110.105 (maybe more). How exactly is this actually working with that
>>address configuration?
>
>Are the xx.xx.110.98-110.105 internal? or is that your public range?
>In which case the ext ip will need to change. "ip address outside
>xx.xx.xx.xx 255.255.255.xxx

Those are the public IPs. The funny thing is, it's working. Traffic to
those IPs ends up at the firewall. Perhaps it's something to do with the
VLAN setup at the hosting company.

>>3) How do I delete a single access-list line? I did "no access-list
>>outside_acces_in" to get rid of multiple lines that were made with a typo
>>(via command recall, of course - didn't make the same typo multiple times).
>>But if I try "no access-list outside_access_in line 5" (which does exist,
>>according to "show access-list"), I get a summary of options for the
>>access-list command. My syntax is completely correct according to the
>>command reference. So what is it that I'm missing?
>
>the "line" is only in pix version 6.3.3 i think? verifiy which
>version of the software you are running with a "show ver". I would
>flash it to 6.3.3 if it is not running that, as it has a lot of extras
>and fixes.

Show version reports 6.3(3), which I assume is 6.3.3 in normal version
syntax.

>to remove the access-list you would pretty much complete the
>access-list command shown with a no in front of it. omit the line ""
>from it when removing if it shows that.
>ex. access-list outside_access_in permit ip any any
>
>to remove it would be "no access-list outside_access_in permit ip any
>any
>
>hope this helps.

I actually thought of that after posting, and it does work to remove the
unwanted lines. 

--
 - Mike
Remove 'spambegone.net' and reverse to send e-mail.

Relevant Pages

  • Re: Public Addresses Used Internally
    ... quality of the firewall. ... With public IPs access must only route into internal network ... There is increased cost with holding the public IPs, ...
    (microsoft.public.security)
  • Re: PIX 506e
    ... Can it handle mapping/portmapping our public IPs to private ones, ... Can I have an additional router behind the firewall (which itself is ... The reason we are wanting a firewall (aside from being able to control ... are not planning a DMZ network for a public server, ...
    (comp.dcom.sys.cisco)
  • Re: Replace private IP by public IP : Big problems !!! ;-(
    ... > This firewall is connected to a router which have Wan IP 192.168.3.254 ... so any traffic from eth0 out eth2 will be ... very easy to configure 3 interfaces for public, DMZ (other public IPs), ...
    (comp.os.linux.networking)
  • Re: how to connect firewall to router
    ... Think of your firewall as having two sides. ... thing headed for any of your Public IPs hits that side. ... use DHCP for servers. ... > I've to connect my linux firewall with my adsl router. ...
    (comp.security.firewalls)
  • RE: [fw-wiz] PIX Books
    ... Cisco Secure PIX Firewall Advanced ... Cisco's site and a thumbable copy of the command reference are ... > Of Shimon Silberschlag ...
    (Firewall-Wizards)