In article < .com>,
Stuart <> wrote:
>The pix config is shown below:
>PIX Version 6.3(3)
As an aside: 6.3(3) has known security difficulties, which are
fixed in the free update 6.3(4).
There are also a fair number of bug fixes in 6.3(5) but that version
requires a support contract to obtain.
>access-list 101 permit tcp any host remoteassist eq www
>access-list 101 permit tcp any host remoteassist eq 3389
>access-list 101 permit tcp any host server2 eq www
>access-list 101 permit tcp any host server eq www
>access-list 101 permit tcp any host server eq pptp
>access-list 101 permit tcp any eq 47 host server eq 47
you do not apepar to use that access-list 101 in your configuration.
>access-list inside_access_in permit ip any any
You apply that "in" the inside interface. Because you are permitting
all ip with it, use of it is redundant upon the default PIX behaviour
when no access-group inside is present. I would suggest removing
the access-group statement and the access
>access-list acl-out permit tcp any host remoteassist eq www
>access-list acl-out permit tcp any host remoteassist eq 3389
>access-list acl-out permit tcp any host server2 eq www
>access-list acl-out permit gre any host server
>access-list acl-out permit tcp any host server eq www
>access-list acl-out permit tcp any host server eq pptp
>access-list acl-out permit tcp any host server eq 82
>global (outside) 1 interface
>global (outside) 1 server
>nat (inside) 1 0.0.0.0 0.0.0.0 0 0
>static (inside,outside) server2 192.168.1.12 netmask 255.255.255.255 0 0
>static (inside,outside) server 192.168.1.11 netmask 255.255.255.255 0 0
That static conflicts with the second global (outside) statement.
It is not permitted to static the entire IP of any IP which appears
in a global PAT or global pool. It -is- permitted to static individual
ports of an IP that appears in a global statement, but I don't think
you want to do that in your case. The effect of the second global
statement would be to use server as the outside IP for packets at the
point where there were no more available ports in the first global PAT
(the interface address.) If you are driving a PIX 501 to that
many connections, the PIX 501 is probably the wrong device for the
situation. I would suggest just deleting the second global statement.
>static (inside,outside) remoteassist 192.168.1.99 netmask 255.255.255.255 0 0
>access-group acl-out in interface outside
>access-group inside_access_in in interface inside
>sysopt connection permit-ipsec
>isakmp enable outside
>isakmp key apple address 0.0.0.0 netmask 0.0.0.0
>vpdn username xxx password xxx
You do not have a vpdn enable statement, and you have no
crypto map statements, so the vpdn is not going to have any
effect and the isakmp is unneeded (and possibly dangerous to
have sitting there without further configuration, though I cannot
think of any attacks on it.) The sysopt is not consistant with
the use of vpdn, as vpdn is only pptp or l2tp and not ipsec.
This suggests that either you chopped some statements out of your
configuration or else that your configuration used to include
some VPN tunnels and has not been completely purged of them.
If those tunnels are still there and you chopped them out of the
posting, then we are trying to give advice based upon an
incomplete description of the situation.
|
Similar Threads
