Re: Please help with Pix 501
- From: roberson@xxxxxxxxxxxxxxxxxx (Walter Roberson)
- Date: Mon, 31 Oct 2005 06:06:11 +0000 (UTC)
In article <dk3ge4$q4c$1@xxxxxxxxxxxxxxxxxxxxxxx>,
Walter Roberson <roberson@xxxxxxxxxxxxxxxxxx> wrote:
>In article <1130699883.279570.226920@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>,
>millsusaf <ebrianmills@xxxxxxxxx> wrote:
>:If someone can write me a 100% functional config
>Changes from your original configuration are marked with '-->'.
Updated as per discussion postings. Really the only thing keeping
your config from being useful before was likely the 'mask' parameter
on your 'ip local pool' command.
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password XXXXXXXXXXXXXXX encrypted
passwd XXXXXXXXXXXXXXXXX encrypted
hostname MillsVPN
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list 101 permit ip 192.168.69.0 255.255.255.0 172.26.69.0 255.255.255.0
pager lines 24
--> : as per your clarification, you do not need any of the extra ACLs
--> : I put in before
--> : this allows the external ping you wanted
--> icmp permit any echo outside
--> : this helps allow your inside hosts to ping to outside
--> icmp permit any echo-reply outside
--> : these help allow inside hosts to be told of unavailable systems
--> icmp permit any unreachable outside
--> icmp permit any time-exceeded outside
mtu outside 1500
mtu inside 1500
ip address outside dhcp setroute
ip address inside 192.168.69.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
--> : the default mask for 172.26 would be 255.255.0.0
--> ip local pool ipool 172.26.69.10-172.26.69.25 mask 255.255.255.0
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http 192.168.69.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
--> : you can run into MTU problems if you do not restrict the TCP MSS
--> : because after the VPN layers, the packet can exceed the 1500
--> : bytes of your MTU
--> sysopt connection tcpmss 1348
crypto ipsec transform-set myset esp-des esp-md5-hmac
--> : you do not NEED to allow AES, but we were talking about it...
--> crypto ipsec transform-set mysetAES esp-aes-256 esp-sha-hmac
--> crypto dynamic-map dynmap 10 set transform-set mysetAES myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap interface outside
isakmp enable outside
--> : if you do not use hostname instead of address, then you will have
--> : difficulties when your ISP changes your IP underneath you
--> isakmp identity hostname
isakmp nat-traversal 20
--> : again you do not need AES, but we were talking about it.
--> isakmp policy 7 authentication pre-share
--> isakmp policy 7 encryption aes-256
--> isakmp policy 7 hash sha
--> isakmp policy 7 group 5
--> : a full day, 86400 seconds, seems a bit much idle time for a VPN
--> : client so I dropped it to one hour
--> isakmp policy 7 lifetime 3600
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
--> : adjusted for a shorter lifetime, as per above
--> isakmp policy 10 lifetime 3600
vpngroup MillsVPN idle-time 6000
vpngroup MillsVPN password XXXXXXXX
--> : remove all the other vpngroup commands that were here, including
--> : the address-pool one
--> vpngroup FamilyA idle-time 6000
--> vpngroup FamilyA password YYYYYYYY
--> vpngroup FamilyB idle-time 6000
--> vpngroup FamilyB password ZZZZZZZZ
telnet 192.168.69.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.69.100-192.168.69.120 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
dhcpd enable inside
terminal width 80
--
Chocolate is "more than a food but less than a drug" -- RJ Huxtable
.
- References:
- Re: Please help with Pix 501
- From: Walter Roberson
- Re: Please help with Pix 501
- From: millsusaf
- Re: Please help with Pix 501
- From: Walter Roberson
- Re: Please help with Pix 501
- Prev by Date: Re: Loopback and VLANS
- Next by Date: Re: PBR for load sharing purposes
- Previous by thread: Re: Please help with Pix 501
- Next by thread: Multiple internal networks
- Index(es):
Relevant Pages
|
