Enabling DES for PDM 1

[dougnc]

I'm trying to run PDM on a 2000 server. The docs at cisco say I have to have DES or 3DES enabled. It's not. How do I do this?

I'm just trying to get my mail server accessed from the outside. I was hoping an automated tool could help here.

Any help would be greatly appreciated.

Doug

 

[phima]

If you have a cco accounf, you can get a free 56-bit DES licence at

http://www.cisco.com/kobayashi/sw-center/internet/pix-56bit-license-request.shtml

Once you'll have received you new activation key, you'll be able to run PDM.
Rgds,
Phil.

 

[yizhar]

HI!

See my post about PIXCRIPT - it is designed for your kind of needs.

Here is a sample (fiction) configuration for you:

nameif ethernet0 outside security0
nameif ethernet1 inside security100
interface ethernet0 auto
interface ethernet1 auto
ip address outside 55.55.55.1 255.255.255.0
ip address inside 10.0.0.254 255.255.255.0
route outside 0.0.0.0 0.0.0.0 0.0.0.0

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) 55.55.55.2 10.0.0.2
access-list 101 permit tcp any host 55.55.55.2 eq smtp
access-group 101 in interface outside


Here is the same config for PIX ver 5.2 and older which does not support access-list commands:

nameif ethernet0 outside security0
nameif ethernet1 inside security100
interface ethernet0 auto
interface ethernet1 auto
ip address outside 55.55.55.1 255.255.255.0
ip address inside 10.0.0.254 255.255.255.0
route outside 0.0.0.0 0.0.0.0 0.0.0.0

nat (inside) 1 0.0.0.0 0.0.0.0

static (inside,outside) 55.55.55.2 10.0.0.2
conduit permit tcp host 55.55.55.2 eq smtp any


Bye
Yizhar
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Bluecrack]

Yizhar's got it. The 3 main statements you need are these:

static (inside,outside) 55.55.55.2 10.0.0.2
access-list 101 permit tcp any host 55.55.55.2 eq smtp
access-group 101 in interface outside

Where 55.55.55.2 is the IP address that the world uses to hit your mail server and 10.0.0.2 is the internal IP address of the mail server.

Bluecrack

 

[yizhar]

HI again.

Please note that you should use different IP addresses for the PIX outside interface, and for the external (known by the internet) IP of your mail server.

If you try to use same IP for both, I don't know if it'll work.

Also one important thing with mail servers is that the you must register the correct IP with your ISP DNS servers using MX record. Contact your ISP for that.
If you already have a registered MX record, try to use that IP for the mail server (in the STATIC and CONDUIT/ACCESS-LIST statements) and give the PIX a different external IP on the outside interface - another IP from the "real" IP addresses you got from the ISP.

I'll add another post here about using single IP with PIX since I'm not sure about that.

Bye
Yizhar
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar