PIX 6.3(3) and PDM 3.0.1 1

[oshill]

I upgraded the PIX and the PDM this weekend and now I lost the ability to configure the PIX from PDM. IT says "PDM does not support mutiple uses of a give Access Control List"
I can not figure out what cammand it is talking about.

Here is my config.

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 2Qc0jqIOMlk.A6uf encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname PIX
domain-name oshill.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 150 permit icmp any host *.*.232.109 echo-reply
access-list 150 permit icmp any host *.*.232.109 source-quench
access-list 150 permit icmp any host *.*.232.109 unreachable
access-list 150 permit icmp any host *.*.232.109 time-exceeded
access-list 150 permit tcp host *.*.147.201 host *.*.232.109 eq ftp
access-list 150 permit tcp host *.*.147.201 host *.*.232.109 eq telnet
access-list 150 permit tcp host *.*.148.40 host *.*.232.109 eq ftp
access-list 150 permit tcp host *.*.148.40 host *.*.232.109 eq telnet
access-list 150 permit tcp host *.*.163.206 host *.*.232.109 eq ftp
access-list 150 permit tcp host *.*.163.206 host *.*.232.109 eq telnet
access-list 101 permit ip 10.16.21.0 255.255.255.0 167.6.0.0 255.255.0.0
access-list 101 permit ip 10.16.20.0 255.255.255.0 167.6.0.0 255.255.0.0
access-list 101 permit ip 10.16.19.0 255.255.255.0 167.6.0.0 255.255.0.0
access-list 101 permit ip 10.16.67.0 255.255.255.0 167.6.0.0 255.255.0.0
access-list inside_access_in permit ip any any
pager lines 24
logging on
mtu outside 1500
mtu inside 1500
ip address outside *.*.*.* 255.255.255.224
ip address inside 10.16.21.2 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 10.16.19.0 255.255.255.0 inside
pdm location 10.16.20.0 255.255.255.0 inside
pdm location 10.16.21.3 255.255.255.255 inside
pdm location 10.16.21.35 255.255.255.255 inside
pdm location 10.16.21.61 255.255.255.255 inside
pdm location 10.16.21.71 255.255.255.255 inside
pdm location 10.16.21.84 255.255.255.255 inside
pdm location 10.16.67.10 255.255.255.255 inside
pdm location 10.16.67.0 255.255.255.0 inside
pdm location 12.160.147.201 255.255.255.255 outside
pdm location *.*.148.40 255.255.255.255 outside
pdm location 10.16.21.66 255.255.255.255 inside
pdm location *.*.163.206 255.255.255.255 outside
pdm location *.*.163.0 255.255.255.0 outside
pdm logging debugging 500
pdm history enable
arp timeout 14400
global (outside) 1 *.*.*.*
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) *.*.*.* 10.16.21.3 netmask 255.255.255.255 0 0
access-group 150 in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 67.39.232.97 1
route inside 10.16.19.0 255.255.255.0 10.16.21.1 1
route inside 10.16.20.0 255.255.255.0 10.16.21.1 1
route inside 10.16.67.0 255.255.255.0 10.16.21.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http *.*.*.* 255.255.255.0 outside
http 10.16.21.84 255.255.255.255 inside
http 10.16.21.71 255.255.255.255 inside
http 10.16.21.66 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside 10.16.21.66 c:\TFTP-Root
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set OEM esp-3des esp-sha-hmac
crypto map international 1 ipsec-isakmp
crypto map international 1 match address 101
crypto map international 1 set peer *.*.236.3
crypto map international 1 set transform-set OEM
crypto map international interface outside
isakmp enable outside
isakmp key ******** address *.*.236.3 netmask 255.255.255.255
isakmp keepalive 200 5
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash sha
isakmp policy 1 group 1
isakmp policy 1 lifetime 28800
telnet 10.16.21.84 255.255.255.255 inside
telnet 10.16.67.10 255.255.255.255 inside
telnet 10.16.21.66 255.255.255.255 inside
telnet timeout 5
ssh timeout 60
console timeout 0
terminal width 80
Cryptochecksum:105c8204d44f3f0d81fb00aee5e8eee7


Can anyone tell me what is up?

 

[themut]

nat (inside) 0 access-list 101
crypto map international 1 match address 101


You're using ACL 101 for two different purposes and PDM doesn't like it. Try the following suggestion instead:

nat (inside) 0 access-list nonat
access-list nonat permit ip 10.16.21.0 255.255.255.0 167.6.0.0 255.255.0.0
access-list nonat permit ip 10.16.20.0 255.255.255.0 167.6.0.0 255.255.0.0
access-list nonat permit ip 10.16.19.0 255.255.255.0 167.6.0.0 255.255.0.0
access-list nonat permit ip 10.16.67.0 255.255.255.0 167.6.0.0 255.255.0.0


And leave the rest as it is.

 

[oshill]

What lines do I need to delete?

 

[oshill]

I got it. Thank you themut.