We have a PIX firewall 515E running version 6.3(4) and there are few site to site VPN's installed on it. We want to find out the isakmp key for those VPN tunnels. On ASA, We can run the command "more system..." and it displays the key, but it seems it doesn't work on the PIX 515E.
View 1 Repliescrypto map mapName 20 match address NAME_20_cryptomapcrypto map mapName 20 set peer IPADDRcrypto map mapName 20 set transform-set ESP-3DES-SHAcrypto map mapName interface IFNAMEcrypto isakmp identity addresscrypto isakmp enable IFNAMEcrypto isakmp policy 10authentication pre-shareencryption 3deshash md5group 2lifetime 86400crypto isakmp policy 30authentication pre-shareencryption 3deshash shagroup 2lifetime 86400crypto isakmp policy 50authentication pre-shareencryption aeshash shagroup 2lifetime 28800(code)
I need to be sure that when traffic matches access-list "NAME_40_cryptomap" Isakmp policy 50 are used. And then traffic matches "NAME_20_cryptomap" isakmp policy 10 are used. How do i link the crypto map with the specefic isakmp policy?
I am trying to setup a VPN tunnel between a PIX and an ASA. I went through the IPSec Site to site wizzard using the same settings but I cannot ping hosts from either side.
Here is the setup
ASA 5520
Device Manager 6.4(5)106
Software version 8.0(5)
Inside network 10.0.0.0/24
Inside IP 10.0.0.1
[code]....
I need to redo the configuration on the new one?
View 11 Replies View RelatedI have an Pix 515E firewall with Pix724-33.bin IOS. I just want to know that does this IOS support SNMPV3 or I will have to upgarde it with some other version.
View 1 Replies View RelatedIve got a problem with passing traffic through a Cisco 515e firewall.im trying to telnet to devices on the inside net, 172.16.x.x fom an outside net 10.x.x.x? ive configured a group called infrastructure and added the 10.x.x.x addresses.ive configured acl 101 inbound on the outside interface:
access-list 101 permit tcp object-group INFRASTRUCTURE any eq telnet
theres a route to the inside net:
inside 172.16.0.0 255.255.0.0 172.16.163.1
and theres a translation:
static (inside,outside) 10.4.4.34 10.4.4.34 netmask 255.255.255.255
when i try and connect, using a packet capture I can see traffic from 10.4.4.34 to the inside device 172.x.x.x on the inside interface but i cant see the traffic leave the outside interface ive used the same group infrastructure group before to connect to VM machines on the 172.x.x.x net on RDP and this wrks ok. access-list 101 permit tcp object-group INFRASTRUCTURE object-group VMs eq 3389
I am trying to set the PIX firewall to transparent mode.After I set it to transparent firewall, I allowed all icmp, tcp, udp traffics.Currently, any devices in the inside network can get the ip automatically from DHCP server in the outside network but cannot ping to any servers in the outside network either access the internet.Do I need additional confiration on the firewall?
Here's the configuration:
PIX Version 7.0(1)
firewall transparent
names
!
interface Ethernet0
[Code]....
I have Pix firewall 515e on inside interface its has configured with IP 192.168.0.254.And Global Nating is configured.
global (outside) 1 interface
nat (inside) 1 192.168.0.0 255.255.255.0 0 0
I want i configured Global nating only for only specific IP address E.g 192.168.0.0-192.168.0.30 and 192.168.0.200-192.168.0.254?How i do this?
I have the following network.2 WAN links termination on my PIX 515e and all internal users connected to third interface.
Problem I am facing is that I have assign manual IP to users with some have full access to Internet while others have limited.
The users are changing their IP address while others are offline and I want to restrict them.
The only way I can think off is by binding IP to MAC as e.g ( Active wall software). But can it be done on PIX 515e and if so how?
I have LMS 4.0 server installed without any problems on windows server Enterprise edition service pack 2 then i enabled SNMP on cisco switches and routers by the following commands [code] But when i tried to discover cisco devices and after trying many times theres no result so correct commands required to be enabled on cisco devices.
View 2 Replies View RelatedNCS 1.1.1.24 (PRIME-NCS-VAPL)
5508-50 WLC 7.0.235.3
I had to re-IP this WLC onto another management vlan. Prior to the IP change and code upgrade I removed the WLC from NCS.When attempting to re-add the WLC to NCS, I finally found the it in Configure>Unknown Devices. Now NCS is showing the Device Type as Unknown, and Inventory Status Detail as Unsupported device, and reachable.
I have one ASA with two tunnels. Each going to a different 3rd party Checkpoint firewall (site A, site B) Each site has two servers (A1, A2, B1, B2)I can only connect to A1 and B1. any connection to A2 and B2 fails. I have defined B2 and A2 in the crypto map to be protected.If I only have B2 or A2 in the crypto map ACL then the tunnel fails. Phase 1 does not come up. Its as if the ASA is ignoring the entries for B2 and A2.ASA running 8.4(2).I have also trashed the VPN and built via the wizard, same result.
View 12 Replies View RelatedI have erased the Cisco image from my PIX 515E, and while i tried to load a new image its asking for activation key. I tried its old key. but no use.
View 1 Replies View RelatedI have a PIX 515 Ewhich does authentication for SSH via RADIUS protocol and fails over to the local database if radius server goes offline. But when the radius server comes back online, authentication still takes place through LOCAL and not the radius server. Following are the commands:
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
[Code].....
\I just configure my PIX 515E with version 7.0(4) and having problems to get traffic out on eth0 (if name outside). There is no problems between different VLAN ,all VLANs are configure on eth1. It is also possible to accass services on VLAN 10 (DMZ) from outside. The only thing I see in syslog is "Built Outbound" and "Teardown".
View 11 Replies View RelatedI have a Pix 515E running PixOS version 8.0.4 with two interfaces, inside and outside.On the inside interface, I have a Redhat Enterprise Linux 5.4 64 bits machine as an NFS server version 4 (NFSv4).On the outside interface, I have three (3) Redhat Enterprise Linux 5.4 64 bits as NFS clients.I am looking for the exact UDP and TCP ports to be added to the ACL in order to accomplish
View 1 Replies View RelatedI need ot upgrade a Cisco PIX 515 E to A Cisco ASA (not sure what type and modle yet!). the PIX currently has about 80 lines of ACLs and no VPNs. So only inside and outside interfaces and 80 lines of ACLs to be transferred over to the ASA.I was wondering if the ACLs can be transferred over to ASA as is?is there anything that I need ot watch for?
View 1 Replies View RelatedI have an issue in the Cisco PIx 515e series. The IOS is 6.1(2).I have set sepecific access-list to allow incoming traffic to inside interface. But still the TCP 3-way handshaking is dropped here. [code]
View 6 Replies View RelatedWhat would be the access-list entry to allow protocol 97? I am setting up foreign-anchor controller and need to allow protocol 97.
View 1 Replies View RelatedI have a team onsite this week inspecting us. We found out yesterday that Retina is unable to access several of our switches. Said switches are able to be pinged from workstations on both of our main VLANs, I can SSH to them from any computer which is included in the ACL (and yes, the Retina server is in the ACL). Users can login to and access all network resources without issue. Each switch is configured with a management IP on the same VLAN. I have created a full-permissions user on each switch specifically for scanning use.
All switches are running the same code (12.2(58)se2). I was just able to SSH from one switch to another (with the user account made for the Retina scan), all through the stack of switches experiencing the problem. While doing so, I did a how log | incl <IP of the Retina server>. 90% of the switches had no records for that IP (thus no attempted connections). The few that did have record of it, reflected a connection over 24 hours ago- and we've just tried it several times within the last 6 hours (it was 0300 when I sent this email to coworkers that I'm snipping into this post).
Im running 8.3 on a 5505. We've got a few ssh tunnels originating from inside to some place on the internet. It seems these tunnels are closed every n minutes. I've seen two recommendations for altering the timeout values, and what I am interested in is infinite timeout (0) for these SSH tunnels.
Suggestion 1, alter timeout "conn". Default is 30 minutes, but I suspect this might have a negative impact because no inactive connections would be closed, ever. If it however is recommended to alter, how to set it to "0" (off/unlimited)? timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Suggestion 2, enable a ssh class map which explicitely set the timeout for the ssh connection. Is this recommended? How would I achieve unlimited time? And what about random-sequence-number disabled as seen below, is that really recommended?
class CLASS_MAP_SSH
set connection random-sequence-number disable
set connection timeout idle 48:00:00 reset
set connection decrement-ttl
I tried looking in ASA documentations but unable to find out that how many IPSec Tunnels can be terminated to an ASA cluster. I have 5545 running only two IPSec Tunnels so far but need to terminate 18 sites all up and would like to confirm how many tunnels we could terminate? Is there a limitaion to it?
View 2 Replies View RelatedWe just switched over from a T1 line to 50/4 Mbps cable Internet. The speed was fine with the T1, but when we switched over to cable, the download speeds didn't increase. I'm getting 2-3 Mbps up and still only 1.5 Mbps down. I inherited this network a few years ago, so I didn't configure the Pix initially but I have been managing it and can't find a setting limiting the bandwidth for the liffe of me. I know it's not the Internet because when I connect a computer straight to the modem, the speed is great. As soon as I put it through the Pix though, it slows way down.
View 8 Replies View RelatedI'm trying to use port redirection to allow outside access to a internal web server. As far as I can see, everything is configured properly. The Open Port Checker tool from yougotsingle.com says that the port (80) is open. However when I goto access it the connection times out. The external address is static from my ISP, and I will call it xxx.xxx.xxx.xxx. The server is at 10.1.1.20, and is functioning properly over the LAN.
View 7 Replies View RelatedI have Cisco PIX 515E for my Lab and can't recover the password. It is not connected to the network. I have configured server, address, gateway from the monitor mode and tftp not seeing my laptop. best way to reset or recover password.
View 7 Replies View RelatedI've been struggling to get ASDM (PDM) installed and running on my PIX 515e. The PIX IOS version is 7.2.4(30) The ASDM version I've copied to flash is 524.
I've followed the Cisco documentation verbatim, however I still cannot connect via the Java ASDM client or via http. When I try to connect via http, my PIX shows the following error: "tcp access denied by acl from..." I do not this this is a security (ACL) issue as I've tested after opening everything up and still no luck.
Here's my running config (w/ the relevant statements prepended with ">>>"):
show run
: Saved
:
[Code]....
I have the following Pix 515E Firewall, that has been working good for a few years. But suddenly, the Pix stop booting up. The only thing that is happening is the power and network traffic led flashes and the active led is off. So my question is that is this symptom a hardware or software problem and is it fixable with either new parts; or is my firewall dead. I suspect that it is a hardware problem since the active led doesn't light up. I cann't even enter the ROM Moniter mode.
View 7 Replies View RelatedWhat would be the command to clear the df-bit on a PIX-515e running 6.3? I have tried the following:
conf t crypto ipsec df-bit clear-df inside and it doesn't take it.
I am facing high CPU util on my pix 515 E which is in failover mode.During peak hours the util is see rising to 60% where as in off peak hours it is normally12%.
During normal operation the average utilisation was observed to be 30% but suddenly from 2/3 days it is constantly 60% doule the value as earlier. Have gone through the logs and traffic but not able to tarce anything particular
below is the o/p of some command taken for analysis
IOS version 8.0(4)
sh cpu usage
CPU utilization for 5 seconds = 51%; 1 minute: 61%; 5 minutes: 58%
sh cpu usage
[Code]......
I need to create a DMZ zone in my network. One server need to be put in DMZ. I have a PIX 515E 6.3.3. It has free port to create DMZ.
1) Put a new switch for DMZ zone
2) Connect it to the DMZ port
3) Create a NAT for inside to DMZ with same IP as inside
4) Create ACL for permiting traffic to DMZ and apply it to outside interface
5) Create ACl for permitting traffic from DMZ to inside
6) Routing for DMZ in PIX
Looking at migrating from the following:
PIX-515EPIX Security Appliance Software Version 8.0(4)Device Manager Version 6.1(5)51
to
ASA5515Cisco Adaptive Security Appliance Software Version 8.6(1)Device Manager Version 6.6(1)
Is this migration directly supported, or do I need to downgrade first?
I was wondering if I picked up a used (End of Life) pix-515e, would would I need to do to be able to upgrade it to that latest version of IOS made for that product? Is it still possible to even get access to that version? Will cisco allow downloads for that devices IOS?
View 4 Replies View RelatedI´ve a problem with my "old" PIX515e device. I wanted to flash this device to a new firmware level but forgot to disable the "lost enable" password before. So I started to make the firmware upgrade on my device, ended up with "flashfs" is busy and I should start the enabled modus and "copy flash tftp" to activate the new flash version. Unfortunalty I cannot do this because I´ve lost my password. When I´m trying to boot this device up now, it will end with a error message...
Unable to locate boot image configuration
Booting first image in flash
No bootable image in flash. Please download an image from a network server in the monitor mode
Failed to find an image to boot
As mentioned, when I will load a new flash image over monitor mode, i cannot activate that image because of flashfs is busy.The password reset bin files will not work too. I tried that too but this one will recongnize no active installed flash.Is there any way to reanimate my PIX515e? In newer devices there are possibilites to work with changing config register but I´ve found nothing about that for a PIX515e.