PIX 506 telnet LAN & open POP to WAN - newbie.

[s7nner]

Hi Guys,

My manager asked me to reconfigure the PIX firewall we have (506 with software v5.1(2)) but i'm pretty clueless on this besides my experience with routers.

He wants to
-open up POP (email) to WAN so that users outside can POP.
-allow webmanagement of firewall.
-allow telnet access (internal + external)

10.0.1.10 is the mail server. My questions are from the above... how do you open up port 110 to allow outside access to users who want POP email? there seems to be no protocol called POP or POP3 in the commands listing.

-with also the telnet access, do i use the Telnet command to point it to the internal interface of the PIX firewall?

thanks in advance for your replies.

*below are the configurations..
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol rtsp 554
names
access-list 1 permit ip 10.0.1.0 255.255.255.192 any
access-list 1 permit icmp 10.0.1.0 255.255.255.192 any
pager lines 24
logging on
no logging timestamp
no logging standby
no logging console
no logging monitor
no logging buffered
no logging trap
no logging history
logging facility 20
logging queue 512
interface ethernet0 10baset
interface ethernet1 10baset
mtu outside 1500
mtu inside 1500
ip address outside 200.10.100.226 255.255.255.240
ip address inside 10.0.1.5 255.255.255.0
arp timeout 14400
global (outside) 1 200.10.100.230 netmask 255.255.255.255
nat (inside) 1 10.0.1.0 255.255.255.192 640 64
static (inside,outside) 200.10.100.229 10.0.1.10 netmask 255.255.255.255 100
50
access-group 1 in interface inside
conduit permit tcp host 200.10.100 eq smtp any
route outside 0.0.0.0 0.0.0.0 200.10.100 1
timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00
timeout rpc 0:10:00 h323 0:05:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
isakmp identity hostname
telnet 10.0.1.0 255.255.255.192 inside
telnet timeout 5
terminal width 80
Cryptochecksum:56d1a7a70f7f98eb56a4a18677b3199f

 

[ccbootcamp]

Hi! Im not trying to be rude, but you might want to hire a security person to handle your pix and other misc. security issues. You've been asked to do some tasks which are NOT considered "industry standard" and could pose some serious security issues.

-brad Network Learning Inc

http://www.ccbootcamp.com

http://www.routerie.com

 

[yizhar]

HI.

First, I agree with Brad ("bootcamp&quot about the need to consider security risks.

Second - Here are some links to help you getting started:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/

http://www.cisco.com/go/pix

http://www.cisco.com/warp/public/110/pix_command_ref.shtml

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_51/syslog/index.htm

http://teachers.sivan.co.il/yizhar/files/pixlinks.htm

Now to the point:
> -open up POP (email) to WAN so that users outside can POP
You can use the same command used to open SMTP:
> conduit permit tcp host 200.10.100 eq smtp any
conduit permit tcp host 200.10.100 eq pop3 any

Or instead you can configure the internal mail server to forward a copy of messages for roaming users to an additional external mailbox at the ISP (or other mail server) instead of allowing plain POP3 in. Another option is POP3 over VPN tunnel.

> -allow webmanagement of firewall
For that you will need to upgrade the pix OS and install PDM. Contact your Cisco dealer for more info.
This is for managing the pix from the inside network with a browser.

> -allow telnet access (internal + external)
For management from internal hosts, use the "telnet" command similar to what you already have:
> telnet 10.0.1.0 255.255.255.192 inside
For management from remote hosts, you cannot use telnet but you can use SSH. It is a bad idea to open SSH to the whole Internet but you can specify remote management ip addresses if you're going to manage the pix from a known fixed ip address or subnet.
Your version (5.1) does not support SSH, but after you upgrade to the newer one you can use that option.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar