Search This Blog

Tuesday, October 04, 2011

Cisco PIX

This posting is mainly for myself, so I have reference when I come back to configure this firewall. I am not a cisco person. This is not the whole story here, just highlights for me. Surprised smilePlease do not take any of this as golden as it is just notes for me and maybe incorrect at this time.

I had to configure a cisco pix the other day, it was setup for natting. Now I had to add ntp and dns access.

So I assumed I would have to setup an access list and assign it.

However in doing this I broke existing connectivity.

It appears that by setting up global natting the firewall then allows all access via this nat.

When I applied my access list to allow connectivity to the new service, it actually stopped existing access.

So by applying the access rule, it then stopped the default all access and only allowed access to the rules I had setup. So to get service back I had to either unbind the access-list which restored the all access or add the rules as and when (my preferred option).

setup named objects

name <ip> <name>

setup object-group

object-group <object group name>

  description <description>

  network-object host <name – as configured with name>

setup access-list (early versions of pix only allow numbered (id) access lists)

access-list <acl id> permit <protocol> any object-group <object group name> eq <port>

bind acl to interface

access-group <id> in interface inside

Global nat (apply to all traffic)

global (outside) 1 <start ext ip range>-<finish ext ip range> netmask

nat (inside) 1 0 0


No comments:

Post a Comment