Access Lists

[rtiv]

Was wondering if some people would like to give their opinions and facts on the following:

We had a company come in about 2 weeks ago and perform an audit on the configs of our 6 PIX Firewalls. One of the recommendatios was:

"Start replacing the numerous conduit statements you have by using access lists seeing that is the way Cisco will be going in the future with PIX configs"

Is this for real ? Should access lists be used over conduits ? If so, why ?

Thanks

 

[yizhar]

HI.

It depends on the version of your pix firewalls, and your plans for the future.

If you are working with version 5.x or older and do not plan to upgrade, and everything is fine currently, you can stay with the conduits.

If you are planning to use new OS and new features like PDM, I would suggest following the suggestion and start using access-list instead.

If you have 3 or more interfaces and many rules, access-list might also have an advantage as they work per interface.

In any case, do NOT mix conduit and access-list in the same device. This can work but is dificult to manage and not practical at all.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[jbordeau]

Hi all,

Yizhar have fully reason.
If you have a pix with 3 interfaces or more, it's important to used access-list but if we have in old configuration a "conduit", the new conf with "access-list" would have to need to rewrite all rules and defined a scheme of network and some different applicative between pc, router etc...
If your case, we have 6 pix. This is very important to :
- Know version pix
- Know pix equipment (pix 520, 525 ?)
- Used Ipsec ?
- Know number of interface by pix ?

After, it's easy to defined number of day to migrated on new firmware.

Bordeau Jerome
France

 

[pixboy]

Glad I looked here before I posted a new thread! Our PIX 520 currently has version 5.2(1). I want to upgrade it to the latest version, but our configuration is pretty elaborate and uses quite a few conduit commands. In looking at the documentation for 6.2, it appears conduit commands are still OK. Of course, they do recommend (as you folks have) that you use access-lists instead.

Our PIX 520 has six interfaces. We use five currently. Will upgrading to 6.2 overly complicate things? And what impact does multiple interfaces have with the conduit-vs.-access-list argument?

Thanks!

Dan