How do you Secure the PIX 506E?

[tsap]

I’m not to familiar with configuring cisco products. It appears by default that all traffic can pass thought this box. My question is, what do I type in to lock it down properly?

I want my users just to have access to the following….

Internet, email, pcanywhere, cisco vpn

What do I type in the command line interface to block all traffic but the above accesses?

 

[Patrickp1973]

By virtue of the ASA security model of the PIX all traffic outbound is allowed since it goes from a higher security interface to a lower security.

Inbound everything is blocked unless explicitly allowed.

When you say Cisco VPN is this allowing internal users to access cisco vpns or inbound allowing them to connect back to your lan?


access-list 102 permit tcp lan-ip lan-sub any eq http
access-list 102 permit tcp lan-ip lan-sub any eq https
access-list 102 permit tcp lan-ip lan-sub any eq pop3
access-list 102 permit tcp lan-ip lan-sub any eq 5631
access-list 102 permit udp lan-ip lan-sub any eq 5632
access-list 102 deny ip any any log

access-group 102 in interface inside



This is basically how you would perform the above asked questions. This would only allow outbound web traffic , pop3 and pcanywhere.

 

[tsap]

thanks for the info.

My vpn users are connecting from any outside public addresses, to use the LAN on the inside.

 

[tsap]

I tried using your above commands...., My PIX said it does not recognize them. I used the command like this....


access-list 102 permit tcp 192.168.111.101 255.255.255.255 any eq 5631

 

[boymarty24]

I assume you want to restrict access from the inside to outside.


access-list 102 permit tcp 192.168.111.101 any host eq 5631
This make host 192.168.111.101 on the inside to have access to port 5631 thru the pix.

If you want everyone have access to port 5631 thru the pix
access-list 102 permit tcp any any eq 5631

access-list 102 permit tcp "source" "destination" eq "port number"

After you typed all permitlines end with.
access-list 102 deny ip any any
access-group 102 in interface inside

If you are using a internal dns you dont have to open ports associated with dns. Otherwise you need to open those ports aswell.

Is it ciscos native client or a pptp client for vpn?

 

[jpm121]

You did go into config mode before typing those commands, right?

config t

 

[Dukester0122]

How do I check the PIX firewall version, we're planning to upgrade PDM 2.0?

 

[lgarner]

show version

The ACL should work as entered, if you're in config mode. Using the "host" keyword, the correct syntax is

config# access-list 102 permit tcp host 192.168.111.101 any eq 5631

The final "deny ip any any" is optional, unless you want to enable logging.