Traffic being blocked

[watchguardmonkey]

Hi

Have this problem with a PIX; the logs tell me why the traffic is being blocked:
15 flags SYN on interface coin
106001: Inbound TCP connection denied from 10.29.12.163/972 to 164.134.161.219/5

but the script on the PIX looks fine:

static (inside,coin) 164.134.161.219 164.134.161.219 netmask 255.255.255.255 0 0

conduit permit tcp host 10.29.12.160 range 10 9999 host 164.134.161.219
conduit permit tcp host 10.29.12.163 range 10 9999 host 164.134.161.219
conduit permit tcp host 10.29.12.163 eq lpd host 164.134.161.219
conduit permit tcp host 10.29.12.160 eq lpd host 164.134.161.219

I read somewhere that you have to apply the config in a certain way when your building it otherwise it wont take, but i've removed and rebuilt from scratch???

anyone have any ideas why the traffic is being blocked?

regards,

 

[routerman]

Have you got an ACL applied to the Interface coin as well? Post up the rest of the config if your still having problems.

 

[watchguardmonkey]

hi,

not 100% sure on how to apply the access-list, is just the same as a router? here's the rest of the config in case I've missed something simple:

PIX Version 5.2(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 coin security60
nameif ethernet3 intf3 security15
hostname beckkie
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
names
pager lines 24
logging on
no logging timestamp
no logging standby
no logging console
no logging monitor
logging buffered warnings
no logging trap
no logging history
logging facility 20
logging queue 512
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
interface ethernet3 auto
mtu outside 1500
mtu inside 1500
mtu coin 1500
mtu intf3 1500
ip address outside 194.189.110.66 255.255.255.192
ip address inside 164.134.161.249 255.255.255.0
ip address coin 10.37.1.10 255.255.0.0
ip address intf3 127.0.0.1 255.255.255.255
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address coin 0.0.0.0
failover ip address intf3 0.0.0.0
arp timeout 14400
global (outside) 1 194.189.110.90-194.189.110.100 netmask 255.255.255.0
global (coin) 1 164.134.161.20-164.134.161.50 netmask 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) 194.189.110.73 164.134.161.215 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.76 164.134.163.174 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.74 164.134.161.8 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.75 164.134.161.9 netmask 255.255.255.255 0 0
static (inside,coin) 164.134.161.250 164.134.161.250 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.77 164.134.161.10 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.100 164.134.161.208 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.78 164.134.161.1 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.70 164.134.161.222 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.79 164.134.161.230 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.71 164.134.161.241 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.80 164.134.163.220 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.81 164.134.163.222 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.82 164.134.163.224 netmask 255.255.255.255 0 0
static (inside,coin) 10.37.0.100 164.134.161.233 netmask 255.255.255.255 0 0
static (inside,coin) 164.134.161.230 164.134.161.230 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.83 164.134.161.14 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.84 164.134.161.233 netmask 255.255.255.255 0 0
static (inside,coin) 164.134.161.219 164.134.161.219 netmask 255.255.255.255 0 0
static (inside,coin) 164.134.161.218 164.134.161.218 netmask 255.255.255.255 0 0
static (inside,coin) 164.134.161.217 164.134.161.217 netmask 255.255.255.255 0 0
static (inside,coin) 164.134.161.186 164.134.161.186 netmask 255.255.255.255 0 0
static (inside,coin) 164.134.161.181 164.134.161.181 netmask 255.255.255.255 0 0
static (inside,coin) 164.134.163.145 164.134.163.145 netmask 255.255.255.255 0 0
static (inside,outside) 194.189.110.67 164.134.161.231 netmask 255.255.255.255 0 0
conduit permit tcp host 194.189.110.67 eq smtp host 194.72.7.145
conduit permit tcp host 194.189.110.74 eq 443 host 194.223.239.165
conduit permit tcp host 164.134.161.250 eq 102 host 164.134.123.7
conduit permit tcp host 194.189.110.69 eq

http://www any

conduit permit tcp host 194.189.110.69 eq 8080 any
conduit permit tcp host 164.134.161.2 eq 8080 any
conduit permit tcp any eq

http://www host

164.134.161.31
conduit permit tcp host 194.189.110.67 eq smtp any
conduit permit tcp host 194.189.110.70 eq 2501 host 195.61.82.248
conduit permit tcp host 194.189.110.70 eq 2502 host 195.61.82.248
conduit permit tcp host 164.134.161.233 eq

http://www host

10.0.0.0
conduit permit tcp host 164.134.161.233 eq

http://www any

conduit permit tcp host 10.37.0.100 eq

http://www any

conduit permit tcp host 194.189.110.67 eq smtp host 194.62.42.123
conduit permit tcp host 164.134.161.230 eq 1604 host 10.0.0.0
conduit permit tcp host 164.134.161.230 eq 1494 host 10.0.0.0
conduit permit tcp host 164.134.161.230 eq 1050 host 10.0.0.0
conduit permit tcp host 164.134.161.230 range 1023 5000 host 10.13.4.44
conduit permit tcp host 10.29.12.160 range 10 9999 host 164.134.161.219
conduit permit tcp host 10.29.12.163 range 10 9999 host 164.134.161.219
conduit permit tcp host 10.29.12.163 eq lpd host 164.134.161.219
conduit permit tcp host 10.29.12.160 eq lpd host 164.134.161.219
outbound 1 deny 0.0.0.0 0.0.0.0 0 tcp
outbound 1 deny 0.0.0.0 0.0.0.0 0 udp
outbound 3 permit 164.134.161.241 255.255.255.255 53 udp
outbound 3 permit 164.134.161.241 255.255.255.255 80 tcp
outbound 3 permit 164.134.161.241 255.255.255.255 443 tcp
outbound 4 permit 164.134.163.215 255.255.255.255 80 tcp
outbound 4 permit 164.134.163.215 255.255.255.255 443 tcp
outbound 4 permit 164.134.163.215 255.255.255.255 53 udp
outbound 4 permit 164.134.163.215 255.255.255.255 21 tcp
outbound 4 permit 164.134.163.215 255.255.255.255 389 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 80 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 53 udp
outbound 5 permit 164.134.161.8 255.255.255.255 21 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 443 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 23 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 8080 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 25 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 43 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 7000 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 10403 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 3389 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 1521 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 7777 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 2502 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 2501 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 1214 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 1214 udp
outbound 5 permit 164.134.161.8 255.255.255.255 2639 tcp
outbound 5 permit 164.134.161.8 255.255.255.255 8900 tcp
outbound 6 permit 164.134.161.9 255.255.255.255 80 tcp
outbound 6 permit 164.134.161.9 255.255.255.255 443 tcp
outbound 6 permit 164.134.161.9 255.255.255.255 53 udp
outbound 6 permit 164.134.161.9 255.255.255.255 21 tcp
outbound 6 permit 164.134.161.9 255.255.255.255 23 tcp
outbound 6 permit 164.134.161.9 255.255.255.255 8080 tcp
outbound 6 permit 164.134.161.9 255.255.255.255 25 tcp
outbound 8 permit 164.134.161.1 255.255.255.255 80 tcp
outbound 8 permit 164.134.161.1 255.255.255.255 443 tcp
outbound 8 permit 164.134.161.1 255.255.255.255 53 udp
outbound 8 permit 164.134.161.1 255.255.255.255 8080 tcp
outbound 8 permit 164.134.161.1 255.255.255.255 21 tcp
outbound 8 permit 164.134.161.1 255.255.255.255 23 tcp
outbound 9 permit 164.134.161.250 255.255.255.255 102 tcp
outbound 9 permit 164.134.161.250 255.255.255.255 25 tcp
outbound 9 permit 164.134.161.250 255.255.255.255 23 tcp
outbound 9 permit 164.134.161.250 255.255.255.255 23 udp
outbound 9 permit 164.134.161.250 255.255.255.255 21 tcp
outbound 9 permit 164.134.161.250 255.255.255.255 53 udp
outbound 9 permit 164.134.161.231 255.255.255.255 25 tcp
outbound 9 permit 164.134.161.231 255.255.255.255 53 udp
outbound 9 permit 164.134.161.231 255.255.255.255 21 tcp
outbound 9 permit 164.134.161.228 255.255.255.255 21 tcp
outbound 9 permit 164.134.161.231 255.255.255.255 80 tcp
outbound 9 permit 164.134.161.231 255.255.255.255 8080 tcp
outbound 10 permit 164.134.161.149 255.255.255.255 80 tcp
outbound 10 permit 164.134.161.149 255.255.255.255 21 tcp
outbound 10 permit 164.134.161.149 255.255.255.255 53 udp
outbound 10 permit 164.134.161.149 255.255.255.255 443 tcp
outbound 10 permit 164.134.161.151 255.255.255.255 80 tcp
outbound 10 permit 164.134.161.151 255.255.255.255 21 tcp
outbound 10 permit 164.134.161.152 255.255.255.255 80 tcp
outbound 10 permit 164.134.161.152 255.255.255.255 21 tcp
outbound 10 permit 164.134.161.152 255.255.255.255 53 udp
outbound 10 permit 164.134.161.152 255.255.255.255 443 tcp
outbound 10 permit 164.134.161.151 255.255.255.255 53 udp
outbound 10 permit 164.134.161.151 255.255.255.255 443 tcp
outbound 10 permit 164.134.161.226 255.255.255.255 21 tcp
outbound 10 permit 164.134.161.226 255.255.255.255 23 tcp
outbound 10 permit 164.134.161.226 255.255.255.255 80 tcp
outbound 11 permit 164.134.161.6 255.255.255.255 80 tcp
outbound 11 permit 164.134.161.6 255.255.255.255 443 tcp
outbound 11 permit 164.134.161.6 255.255.255.255 53 udp
outbound 11 permit 164.134.161.6 255.255.255.255 8080 tcp
outbound 11 permit 164.134.161.6 255.255.255.255 21 tcp
outbound 11 permit 164.134.161.6 255.255.255.255 23 tcp
outbound 11 permit 164.134.161.6 255.255.255.255 1521 tcp
outbound 11 permit 164.134.161.6 255.255.255.255 9500 tcp
outbound 12 permit 164.134.161.7 255.255.255.255 80 tcp
outbound 12 permit 164.134.161.7 255.255.255.255 21 tcp
outbound 12 permit 164.134.161.7 255.255.255.255 53 udp
outbound 12 permit 164.134.161.7 255.255.255.255 8080 tcp
outbound 12 permit 164.134.161.7 255.255.255.255 443 tcp
outbound 13 permit 164.134.161.232 255.255.255.255 80 tcp
outbound 13 permit 164.134.161.232 255.255.255.255 21 tcp
outbound 13 permit 164.134.161.232 255.255.255.255 443 tcp
outbound 13 permit 164.134.161.232 255.255.255.255 53 tcp
outbound 13 permit 164.134.161.232 255.255.255.255 8008 tcp
outbound 13 permit 164.134.161.232 255.255.255.255 2502 tcp
outbound 13 permit 164.134.161.232 255.255.255.255 2501 tcp
outbound 13 permit 164.134.161.232 255.255.255.255 25 tcp
outbound 13 permit 164.134.161.232 255.255.255.255 8080 tcp
outbound 13 permit 164.134.161.232 255.255.255.255 23 tcp
outbound 14 permit 164.134.161.4 255.255.255.255 80 tcp
outbound 14 permit 164.134.161.4 255.255.255.255 443 tcp
outbound 14 permit 164.134.161.4 255.255.255.255 53 udp
outbound 14 permit 164.134.161.4 255.255.255.255 8080 tcp
outbound 14 permit 164.134.161.4 255.255.255.255 21 tcp
outbound 14 permit 164.134.161.4 255.255.255.255 23 tcp
outbound 15 permit 164.134.161.10 255.255.255.255 80 tcp
outbound 15 permit 164.134.161.10 255.255.255.255 443 tcp
outbound 15 permit 164.134.161.10 255.255.255.255 53 udp
outbound 15 permit 164.134.161.10 255.255.255.255 8080 tcp
outbound 15 permit 164.134.161.10 255.255.255.255 23 tcp
outbound 15 permit 164.134.161.10 255.255.255.255 21 tcp
outbound 16 permit 164.134.161.222 255.255.255.255 21 tcp
outbound 16 permit 164.134.161.222 255.255.255.255 8080 tcp
outbound 16 permit 164.134.161.222 255.255.255.255 53 udp
outbound 16 permit 164.134.161.222 255.255.255.255 443 tcp
outbound 16 permit 164.134.161.222 255.255.255.255 80 tcp
outbound 16 permit 164.134.161.229 255.255.255.255 21 tcp
outbound 16 permit 164.134.161.230 255.255.255.255 21 tcp
outbound 16 permit 164.134.161.230 255.255.255.255 8080 tcp
outbound 16 permit 164.134.161.230 255.255.255.255 53 tcp
outbound 16 permit 164.134.161.230 255.255.255.255 443 tcp
outbound 16 permit 164.134.161.230 255.255.255.255 80 tcp
outbound 16 permit 164.134.161.222 255.255.255.255 2501 tcp
outbound 16 permit 164.134.161.222 255.255.255.255 2502 tcp
outbound 16 permit 164.134.161.222 255.255.255.255 39682 tcp
outbound 16 permit 164.134.161.234 255.255.255.255 21 tcp
outbound 16 permit 164.134.161.234 255.255.255.255 8080 tcp
outbound 16 permit 164.134.161.234 255.255.255.255 53 udp
outbound 16 permit 164.134.161.234 255.255.255.255 443 tcp
outbound 16 permit 164.134.161.234 255.255.255.255 80 tcp
outbound 16 permit 164.134.161.222 255.255.255.255 22 tcp
outbound 16 permit 164.134.161.233 255.255.255.255 8080 tcp
outbound 17 permit 164.134.161.13 255.255.255.255 21 tcp
outbound 17 permit 164.134.161.14 255.255.255.255 21 tcp
outbound 17 permit 164.134.161.14 255.255.255.255 53 tcp
outbound 17 permit 164.134.161.14 255.255.255.255 80 tcp
outbound 18 permit 164.134.163.220 255.255.255.255 80 tcp
outbound 18 permit 164.134.163.220 255.255.255.255 443 tcp
outbound 18 permit 164.134.163.220 255.255.255.255 53 tcp
outbound 18 permit 164.134.163.220 255.255.255.255 21 tcp
outbound 18 permit 164.134.163.224 255.255.255.255 21 tcp
outbound 18 permit 164.134.163.224 255.255.255.255 443 tcp
outbound 18 permit 164.134.163.224 255.255.255.255 53 tcp
outbound 18 permit 164.134.163.224 255.255.255.255 80 tcp
outbound 19 permit 164.134.163.222 255.255.255.255 80 tcp
outbound 19 permit 164.134.163.222 255.255.255.255 21 tcp
outbound 19 permit 164.134.163.222 255.255.255.255 443 tcp
outbound 19 permit 164.134.163.222 255.255.255.255 53 tcp
outbound 19 permit 164.134.163.79 255.255.255.255 21 tcp
outbound 20 permit 164.134.161.31 255.255.255.255 80 tcp
outbound 20 permit 164.134.161.31 255.255.255.255 53 tcp
outbound 20 permit 164.134.161.31 255.255.255.255 443 tcp
outbound 20 permit 164.134.161.31 255.255.255.255 21 tcp
outbound 21 permit 164.134.161.230 255.255.255.255 1023-5000 tcp
outbound 22 permit 0.0.0.0 0.0.0.0 0 icmp
outbound 23 permit 164.134.161.233 255.255.255.255 80 tcp
outbound 23 permit 164.134.161.233 255.255.255.255 53 tcp
outbound 23 permit 164.134.161.233 255.255.255.255 21 tcp
outbound 23 permit 164.134.161.233 255.255.255.255 443 tcp
outbound 23 permit 164.134.161.233 255.255.255.255 25 tcp
outbound 24 permit 164.134.161.0 255.255.255.0 9500 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 9500 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 2510 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 2502 tcp
outbound 24 permit 164.134.161.9 255.255.255.0 9500 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 9000 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 80 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 8081 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 8082 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 8083 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 31415 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 31416 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 31418 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 1521 tcp
outbound 24 permit 164.134.0.0 255.255.0.0 1526 tcp
outbound 25 permit 164.134.161.181 255.255.255.255 0 tcp
outbound 25 permit 164.134.161.219 255.255.255.255 2-10000 tcp
apply (inside) 20 outgoing_src
apply (inside) 19 outgoing_src
apply (inside) 18 outgoing_src
apply (inside) 17 outgoing_src
apply (inside) 16 outgoing_src
apply (inside) 15 outgoing_src
apply (inside) 14 outgoing_src
apply (inside) 11 outgoing_src
apply (inside) 8 outgoing_src
apply (inside) 9 outgoing_src
apply (inside) 5 outgoing_src
apply (inside) 4 outgoing_src
apply (inside) 3 outgoing_src
apply (inside) 6 outgoing_src
apply (inside) 1 outgoing_src
apply (inside) 10 outgoing_src
apply (inside) 13 outgoing_src
apply (inside) 23 outgoing_src
apply (inside) 12 outgoing_src
apply (inside) 24 outgoing_src
apply (coin) 20 outgoing_src
apply (coin) 21 outgoing_src
apply (coin) 11 outgoing_src
apply (coin) 24 outgoing_src
apply (coin) 25 outgoing_src
rip inside passive version 1
rip inside default version 1
route outside 0.0.0.0 0.0.0.0 194.189.110.65 1
route coin 10.9.0.0 255.255.0.0 10.31.1.10 1
route coin 10.13.0.0 255.255.0.0 10.31.1.10 1
route coin 10.21.0.0 255.255.0.0 10.37.1.10 1
route coin 10.29.0.0 255.255.0.0 10.37.1.10 1
route coin 10.45.0.0 255.255.0.0 10.37.1.10 1
route coin 164.134.0.0 255.255.0.0 10.37.1.1 1
route outside 164.134.80.195 255.255.255.255 194.189.110.65 1
route inside 164.134.163.0 255.255.255.0 164.134.161.252 1
route coin 212.196.72.0 255.255.255.0 10.37.1.10 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ (inside) host 164.134.161.249 ********** timeout 5
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server inside 164.134.161.8 /cisco/tftp/fire_conf
floodguard enable
no sysopt route dnat
isakmp identity hostname
telnet 164.134.161.8 255.255.255.255 inside
telnet 164.134.161.252 255.255.255.255 inside
telnet 164.134.161.250 255.255.255.255 inside
telnet 164.134.161.9 255.255.255.255 inside
telnet 164.134.161.1 255.255.255.255 inside
telnet 10.29.12.160 255.255.255.255 inside
telnet 164.134.161.8 255.255.255.255 coin
telnet 164.134.161.252 255.255.255.255 coin
telnet 164.134.161.250 255.255.255.255 coin
telnet 164.134.161.9 255.255.255.255 coin
telnet 10.29.12.160 255.255.255.255 coin
telnet 164.134.161.8 255.255.255.255 intf3
telnet 164.134.161.252 255.255.255.255 intf3
telnet 164.134.161.250 255.255.255.255 intf3
telnet 164.134.161.9 255.255.255.255 intf3
telnet 10.29.12.160 255.255.255.255 intf3
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:5dba6b86c79d891f9ad16ace8c61192d

cheers.

 

[dopehead]

First of all get some new software and convert those outbound/conduit to acls. Cisco CCO site has a utility to do this automatically.

Jan

Network Systems Engineer
CCNA/CQS

 

[paulduffany]

static (inside,coin) 164.134.161.219 164.134.161.219 netmask 255.255.255.255 0 0

conduit permit tcp host 10.29.12.160 range 10 9999 host 164.134.161.219
conduit permit tcp host 10.29.12.163 range 10 9999 host 164.134.161.219
conduit permit tcp host 10.29.12.163 eq lpd host 164.134.161.219
conduit permit tcp host 10.29.12.160 eq lpd host 164.134.161.219

Conduits work in reverse compared to access-lists.
Your Conduit says destination is the 10.29.x.x not the 164.
As far as the Access-list converter, be careful it doesnt work that well.

I use conduits in one firewall that will require a rework, tried the ACL tool and it sucked.