General discussion

  • Creator
    Topic
  • #2296026

    Cisco PIX 501

    Locked

    by mart h ·

    Being a newbie to the pix 501 I am trying to implement a rule set that allows access to ftp and denys all other protocols.

    I have config’d nat and a global pool for internal and external hosts, set the relevant rules
    – allow inside, outside for ftp

    and then established a clean up rule
    – deny ip any

    The result of this blocks all traffic including ftp

    I assume that the pic processes rules in order then branches when it hits an accept rule avioding the clean up rule… am I right or wrong?

    can anyone suggest ‘the correct’ rule config to fix the problem or at least offer any explanation why the simple ruleset may not work

All Comments

  • Author
    Replies
    • #2671251

      Reply To: Cisco PIX 501

      by Anonymous ·

      In reply to Cisco PIX 501

      Which direction will the FTP access be needed?

      If it’s internal ( I am assuming here) then you need to create a CONDUIT or an ACL for that traffic to get in AND you’ll need to create a static nat mapping for the FTP server.

      If you need to discuss this further, please post on my site:

      http://www.bbfree.com/Tech

    • #3370208

      Reply To: Cisco PIX 501

      by cw ·

      In reply to Cisco PIX 501

      I assume you are using access lists. The PIX does not process Access Lists the same as a Cisco router. Your “deny IP any” statement is erroneous, since the PIX blocks by default, anything not specifically permitted. Take it out, and configure your access list like this.

      Access-list 101 permit tcp host xxxx(registered address of your FTP server that is specified in your static NAT mappings)any eq FTP

      That is the right way.

      Hope this helps

      Chris Weber CCDP

      • #3370207

        Reply To: Cisco PIX 501

        by cw ·

        In reply to Reply To: Cisco PIX 501

        And be sure to apply your access-list to the outside interface.

        access-group 101 in interface outside

        Chris Weber CCDP

      • #3382204

        Reply To: Cisco PIX 501

        by mart h ·

        In reply to Reply To: Cisco PIX 501

        Very helpfull solved the problem..

    • #3382203

      Reply To: Cisco PIX 501

      by mart h ·

      In reply to Cisco PIX 501

      This question was closed by the author

Viewing 2 reply threads