Tag Info

Hot answers tagged

6

It's allowing all IP traffic from the 165.138.236.0/24 subnet to the 165.139.2.0/24 subnet. It's probably being used as a match list on a VPN tunnel or to prevent NAT on tunneled traffic. The number, 110, is just an arbitrary number to identify the access list. "Permit" indicates that it will permit the traffic (as opposed to deny). "IP" indicates to match ...


6

Edit: Sorry, I was reading the tech specs wrong. You need a 5510 to support over 25 vpn clients. The Security Plus bundle and the Anyconnect Essentials bundle still apply. Yes, it has more power under the bonnet than a PIX 506E. You get exactly 10 ipsec licenses with the standard version, with Security Plus (bundle) you'll get 25 ipsec licenses, unlimited ...


6

Seems like you've already found your answer: After doing some frantic google research, I think I can safely say that our primary issue here is the need to change the public ip address of our DNS record to accurately reflect the change in ip address that came along with our changing of ISPs. In other words, this has nothing to do with the ASA or the ...


5

The ACL you're talking about is typically applied to traffic coming into the interface named "inside". The ACL is used to limit traffc that's bound for the "outside", but often it's applied with the command: access-group inside_access_in in interface inside So, you're limiting outbound access by limiting the traffic that can come into the firewall from ...


5

Connect your pix to the Verizon router then the switch to the pix and servers to the switch. You don't need the 3600 router as Verizon already provide you a router. Put the pix in transparent mode. You will not get any better performance if you connect more than 1 cable between routers and switch unless your internet access is > 100mbits and the Verizon ...


5

The Land Attack spoofs the source and destination IP to be the same basically causing the machine to continuously reply to itself causing a DOS. It's a pretty old attack and most OS's are now patched to not be vulnerable to this. In this case I think your PIX is doing what it's supposed to and dropping the traffic. I don't think you have anything to worry ...


5

I found this which seems to give a good bg. I upgraded a PIX last year to latest ios and then migrated to ASA and seem to remember that the tools provided were really good and that the rules were brought across without incident. The most important thing is to make sure you have backups in place before doing anything! Good Luck


5

It should be the standard setup - basically you are supposed to put a router on the /30 and then they should route the other IP addresses to that router. I normally would not like my device IP's (and that includes servers) to be directly attached to the ISP. Whatever I did in the last 15 years or so always had this setup, and I was always using a router / ...


4

Yes, that error message is pretty much the answer: you can't configure the same VLAN on multiple interfaces. The only device in that product line with switch capabilities is ASA 5505.


4

They gave you a pix 501 to stop a DDoS ? outch sorry but that's a crappy old SOHO class firewall it will probably make things worse. Tell them to filter the traffic upstream of your connection


4

No, the 5505 only supports 25 VPN users. Upon further investigation, it supports 25 ipsec clients, and 25 AnyConnect, but not sure if that's concurrent.


4

Chances are pretty good that you've got a mismatched speed / duplex setting on one (or both) of these links... interface ethernet0 100full interface ethernet1 100full Almost all ethernet interfaces default to autonegotiation. If you have configured manual speed / duplex on these firewall interfaces, then autonegotiation on the other side will fail ...


4

While TomTom is correct based on his reading of the question, the OP might also be referring to a very common provisioning that ISPs do. The OP is calling it "LAN" IPs, but in reality they are WAN IPs assigned for his LAN "devices". An example would be: ISP assigns the "WAN" to a /30: ISP side = 1.1.1.1 WAN port on router = 1.1.1.2 ISP ...


3

Nat would be the traditional solution when the customers have overlapping IPs. Pick an unused subnet on one side and NAT it to an unused subnet on the other side. This may cause problems with some protocols. Some information on ASA NAT here, but there are plenty of guides on the Internet. ...


3

If it's running PIX 6.x software or earlier, you have to do it the old-fashioned way: copy and paste. PIX 6.x and earlier will let you write net to copy to TFTP, but the copy command has no way to pull it back in from TFTP. You'll need to copy and paste the configuration into a console, telnet, or SSH session. If it's a 515 or higher running 7.x or 8.x, you ...


3

You should look at the rest of the config to see if there is a rule such as VPN or NAT referencing ACL 110 doing a: sh run | i 110 will give you all the lines thave have 110 - i realize there is the posibility of fluff from ip address ect, but it shouldn't be too much.


3

This post from Cisco seems to clarify the dates a bit looks like certain extended support is still around, but purchasing one has pretty much ended that said, the ASA is a worthy replacement and still going strong I believe


3

GNS Is the best one out there that i've been able to find. You'll have to get your hands on your own IOS images though. I was once told of someone using it as a production router ... don't know why but they were.


3

Have your hosting company clear the arp cache.


3

Why are you doing this all manually? Cisco offers a Pix to ASA migration tool. Run your config through that and then just verify the results before you put it into production (and stop using des encryption. Use 3des or aes). EDIT: Sorry. It's been a while since I've used that migration tool. I thought it did the VPN stuff. Here's what your configuration ...


3

The PIX 515 can saturate at least one 100Mb connection, (almost) no matter what it's doing. Your problem is almost certainly with whatever it's plugged into. It could possibly be that the configuration has the bandwidth limited too.


2

I think a lot of people still use the name PIX for ASA gear as well, so you may just want to clarify with them the actual product being used.


2

Because it's the name of the interface "inside" that you're pointing at. In other words you're going "in" to the inside interface.


2

You will actually want to setup stateful fail over (at least for the PIX/ASA) instead of just copying the config, that way if one device goes down at most you have a blink of non-stateful protocols. here is example of my fail over config: failover failover lan unit primary failover lan interface FAILOVER GigabitEthernet0/2 failover key ***** failover ...


2

It depends what you want to do. PIX is still good.515e and 535 even the old 506e . As I said before it depends on your requirements of design.I still use and deploy them. Configure them good and they are solid. Devices and age ,old or new is not the problem. It is the person configuring them and whether it supports what you want to do. People think ...


2

what PIX version? The feature you want to use is Port Redirection. The basic syntax should be: static (INTERFACE1,INTERFACE2) PROTOCOL IPADDRESS2 PORT2 IPADDRESS1 PORT1 netmask NETMASK so for example: static (INTERFACE1,INTERFACE2) tcp yourexternalip smtp 192.168.0.1 smtp netmask 255.255.255.255 And on your ACL you will need something like this: ...


2

if you can "find" *cough * * cough * a copy of Packet Tracer out there, it will allow you to directly configure the routers through IOS, as well as add or remove modules from the hardware. not to mention it includes more than just routers, you can design logical and physical networks, that connect, and send packets... its crazy, check it out ...


2

Please DO NOT use the no failover command as mentioned by natacado. Instead, use the no failover active command on the secondary (currently active) firewall. The first command turns off failover; the second command relinquishes active status to the other firewall in the HA pair. If you run failover active, please run it on the primary (currently standby) ...


2

Mac address are indeed cached, but the lifetime of an entry is quite short (few minutes). I think that when you changed the smoothwall by a pix, it took some time more because of some dns caching that arp caching. As you're not changing IPs on your setup, it should work without any delay.



Only top voted, non community-wiki answers of a minimum length are eligible