Chapter 1, "Introduction" for important information about command line guidelines including ports and protocols.
Chapter 2, "Configuring the PIX Firewall" for information about configuring PIX Firewall for initial access, server access, authentication, and troubleshooting.
The Release Notes for the PIX Firewall for the latest information about new features, command changes, and usage notes available online at:

: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v42/pixrn420.htm

The following notes can help you as you configure the PIX Firewall:

View your configuration at any time with the write terminal command.
Save your configuration frequently with the write memory command.
Always check the syntax before entering a command. Enter a command and press the Enter key to view a quick summary, or precede a command with help, as in, help aaa.
View syslog messages as you work on the PIX Firewall. Start accumulating messages with the logging buffered 7 command, view messages with the show logging command, and clear the message buffer with the clear logging command. Syslog messages are described in the System Log Messages for the PIX Firewall available online at:

: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v42/syslog/index.htm

Abbreviate commands, such as, co t to start configuration mode, wr t to list the configuration, and wr m to write to Flash memory. Start logging with lo b 7 and show messages with sh lo.
After changing or removing the alias, conduit, global, nat, outbound, and static commands, use the clear xlate command to make the IP addresses available for access. If access still does not work, save the configuration to Flash memory with the write memory command and reboot.
View possible port and protocol numbers at the following IANA web sites:

: http://www.isi.edu/in-notes/iana/assignments/port-numbers
: http://www.isi.edu/in-notes/iana/assignments/protocol-numbers

Create your configuration on a text editor and then cut and paste it into the configuration. PIX Firewall lets you paste in a line at a time or the whole configuration. Always check your configuration after pasting large blocks of text to be sure everything copied.

aaa

Enable, disable, or view TACACS+ or RADIUS user authentication, authorization, and accounting for the server previously designated with the radius-server or tacacs-server commands.

(Configuration mode.)

Syntax Description


accounting	Enable or disable accounting services with authentication server. Use of this command requires that you previously used either the radius-server or tacacs-server command to designate an authentication server.
authentication	Enable or disable user authentication, prompt user for username and password, and verify information with authentication server. When used with the console option, enables or disables authentication service for access to the PIX Firewall console over Telnet or from the Console connector on the PIX Firewall unit. Use of the aaa authentication command requires that you previously used either the radius-server or tacacs-server command to designate an authentication server.
authorization	Enable or disable TACACS+ user authorization for services (PIX Firewall does not support RADIUS authorization). The authentication server determines what services the user is authorized to access.
authen_service	The application with which a user is accessing a network. Use any, ftp, http, or telnet. The any value enables accounting or authentication for all TCP services. To have users prompted for authentication credentials, they must use FTP, HTTP, or Telnet. (HTTP is the Web and only applies to web browsers that can prompt for a username and password.) If the authentication or authorization server is authenticating services other than FTP, HTTP, or Telnet, using any will not permit those services to authenticate in the firewall. The firewall only knows how to communicate with FTP, HTTP, and Telnet for authentication and authorization.
	Only set this parameter to a service other than any if the authentication or authorization server is set the same way. Unless you want to temporarily restrict access to a specific service, setting a service in this command can increase system administration work and may cause all connections to fail if the authentication or authorization server is authenticating one service and you set this command to another.
$/#	The services which require authorization. Services not specified are authorized implicitly. Services specified in the aaa authentication command do not affect the services which require authorization. where $ is the protocol (0 for TCP, 17 for UDP, 1 for ICMP, and so on) and # is the TCP or UDP destination port, or the ICMP type; that is, 8 for ICMP echo or ping. For protocols other than TCP, UDP, and ICMP the # is not applicable and should not be used. For example: aaa authorization udp/53 inbound 0 0 0 0 This example enables authorization for DNS lookups from the outside interface for all clients.
except	Create an exception to a previously specified set of services.
inbound	Authenticate or authorize inbound connections. Inbound means the connection originates on the outside interface and is being directed to the inside or perimeter.
outbound	Authenticate or authorize outbound connections. Outbound means the connection originates on the inside and is being directed to the outside or perimeter.
if_name	Interface name from which users require authentication. Use if_name in combination with the local_ip address and the foreign_ip address to determine where access is sought and from whom. The local_ip address is always on the highest security level interface and foreign_ip is always on the lowest. Refer to the Examples section for how the if_name affects the use of this command.
local_ip	The IP address of the highest security level interface from which or to which access is sought. You can set this address to 0 to let the authentication server decide which hosts are authenticated.
local_mask	Network mask of local_ip. Always specify a specific mask value. Use 0 if the IP address is 0.
foreign_ip	The IP address of the lowest security level interface from which or to which access is sought.
foreign_mask	Network mask of foreign_ip. Always specify a specific mask value. Use 0 if the IP address is 0.
console	Specify that access to the PIX Firewall console require authentication. If used with the any keyword, access to the serial console or Telnet to the PIX Firewall's console must be authenticated with the authentication server. If used with the telnet keyword, then only Telnet access to the PIX Firewall console requires authentication from the authentication server. Telnet access to the PIX Firewall console is only available from the inside interface and requires previous use of the tcpchecksum command.
	Authentication of the serial console creates a potential dead-lock situation if the authentication server requests are not answered and you need access to the console to attempt diagnosis. If the console login request to authentication times out, you can gain access to the PIX Firewall from the serial console by entering the pix username and the enable password. The maximum password length for accessing the console is 16 characters.
tacacs+	Authenticate using Terminal Access Controller Access Control System Plus (TACACS+).
radius	Authenticate using Remote Authentication Dial-In User Service (RADIUS).

Usage Guidelines

The aaa command enables or disables:

User authentication services. A user starting a connection via FTP, Telnet, or over the World Wide Web is prompted for their username and password. An authentication server, designated previously with the tacacs-server or radius-server command, verifies whether the username and password are correct. If the username and password are correct, PIX Firewall lets further traffic between the authentication server and the connection interact independently through the PIX Firewall's "Cut-Through Proxy" feature.
Authentication access to the PIX Firewall's console via Telnet or the serial console connector. (Telnet access requires previous use of the tcpchecksum command.)
User authorization services for TACACS+ connections that let the authentication server determine which services the user can access.
Accounting services so that administrators can track which hosts accessed the PIX Firewall.

Note PIX Firewall does not support RADIUS authorization.

Usage Notes

1. You can change the authentication prompt with the auth-prompt command.

2. The aaa command is not intended to mandate your security policy. The authentication and authorization servers determine whether a user can or cannot access the system, what services can be accessed, and what IP addresses the user can access.The PIX Firewall interacts with FTP, HTTP (Web access), and Telnet to display the credentials prompts for logging in to the network or logging in to exit the network. You can specify that only a single service be authenticated, but this must agree with the authentication server to ensure that both the firewall and server agree.

3. You can now specify an interface name with aaa authentication. In previous versions, if you specified aaa authentication any outbound 0 0 server, PIX Firewall only authenticated outbound connections and not those to the perimeter interface. PIX Firewall now authenticates any outbound connection to the outside as well as to hosts on the perimeter interface. To preserve the behavior of previous versions, use these commands to enable authentication and to disable authentication from the inside to the perimeter interface:

aaa authentication any outbound 0 0 server
aaa authentication except outbound perim_net perim_mask server

4. If you want to allow connections to come from any host, code the IP address and mask as 0.0.0.0 0.0.0.0, or 0 0.When the web server and the authentication server are on different hosts, use the virtual command to get the correct authentication behavior.

5. When using HTTP authentication to a site running Microsoft IIS that has "Basic text authentication" or "NT Challenge" enabled, users may be denied access from the Microsoft IIS server. This occurs because the browser appends the string: "Authorization: Basic=Uuhjksdkfhk==" to the HTTP GET commands. This string contains the PIX Firewall authentication credentials.

Windows NT Microsoft IIS servers respond to the credentials and assume that a Windows NT user is trying to access privileged pages on the server. Unless the PIX Firewall username password combination is exactly the same as a valid Windows NT username and password combination on the Microsoft IIS server, the HTTP GET command is denied.

To solve this problem, PIX Firewall provides the virtual http command which redirects the browser's initial connection to another IP address, authenticates the user, then redirects the browser back to the URL which the user originally requested.

Once authenticated, a user never has to reauthenticate no matter how low the PIX Firewall uauth timeout is set. This is because the browser caches the "Authorization: Basic=Uuhjksdkfhk==" string in every subsequent connection to that particular site. This can only be cleared when the user exits all instances of Netscape Navigator or Internet Explorer and restarts. Flushing the cache is of no use.

As long as the user repeatedly browses the Internet, the browser resends the "Authorization: Basic=Uuhjksdkfhk==" string to transparently reauthenticate the user.

6. You cannot authorize FTP using a web browser's FTP; for example, ftp://ftp.xxx.com, and expect the World Wide Web HTTP authentication screen to display. To enable authorization for Web use, but not FTP, use these commands:

aaa authorization http outbound source_ip netmask
aaa authorization telnet outbound source_ip netmask

FTP authorization is only supported for command line FTP clients or ws_ftp (a Windows GUI-based FTP client).

7. Use of the aaa authorization command requires previous use of the aaa authentication command; however, use of the aaa authentication command does not require use of an aaa authorization command.

8. For outbound connections, first use the nat command to determine which IP addresses can access the firewall. For inbound connections, first use the static and conduit commands to determine which inside IP addresses can be accessed through the firewall from the outside network.

9. When a host is configured for authentication, all users on the host have to use a web browser or Telnet first before performing any other networking activity, such as accessing mail or a news reader. The reason for this is that users must first establish their authentication credentials and programs such as mail agents and newsreaders do not have authentication challenge prompts.

10. The PIX Firewall only accepts 7-bit characters during authentication. After authentication, the client and server can negotiate for 8-bits if required. During authentication, the PIX Firewall only negotiates Go-Ahead, Echo, and NVT (network virtual terminal).

11. Up to 16 TACACS+ or RADIUS servers are permitted. When a user logs in, the servers are accessed one at a time starting with the first server you specify in the configuration, until a server responds.

12. For each IP address, one aaa authentication command is permitted for inbound connections and one for outbound connections. Also, for an IP address, one aaa authorization command is permitted. If you want to authorize more than one service with aaa authorization, use the any parameter for the service type.

13. The PIX Firewall permits only one authentication type per network. For example, if one network connects through the PIX Firewall using TACACS+ for authentication, another network connecting through the PIX Firewall can authenticate with RADIUS, but one network cannot authenticate with both TACACS+ and RADIUS.

14. The PIX Firewall permits a user up to four chances to log in with Telnet and then if the username or password still fails, the PIX Firewall drops the connection. If a user enters an incorrect password in FTP, the connection is dropped immediately. If a user enters an incorrect password in HTTP, the user is reprompted.

15. For the TACACS+ server, if you do not specify a key to the tacacs-server command, no encryption occurs.

16. Network browsers such as Netscape Navigator do not present a challenge value during authentication; therefore, only password authentication can be used from a network browser.

17. Some FTP graphical user interfaces (GUIs) do not display challenge values.

18. If the username or password on the authentication database differs from the username or password on the remote host to which you are using FTP to access, enter the username and password in these formats:

authentication_user_name@remote_system_user_name
authentication_password@remote_system_password

If you daisy-chain PIX Firewall units, Telnet authentication works in the same way as a single unit, but FTP and HTTP authentication have additional complexity for users because they have to enter each password and username with an additional at (@) character and password or username for each daisy-chained system. Users can exceed the 63-character password limit depending on how many units are daisy-chained and password length.

19. PIX Firewall supports authentication usernames up to 127 characters and passwords of up to 63 characters. A password or username may not contain an at (@) character as part of the password or username string, except as shown in Note 18.

20. If the first attempt at authorization fails and a second attempt causes a timeout, use the
service resetinbound command to reset the client that failed the authorization so that it will not retransmit any connections. An example authorization timeout message in Telnet is:

Unable to connect to remote host: Connection timed out

See also: radius-server, tacacs-server, virtual , tcpchecksum.

Examples

1. The following examples demonstrate ways to use the if_name parameter. The PIX Firewall has an inside network of 192.168.1.0, an outside network of 204.31.17.0, and a perimeter network of 192.150.50.0.

This example enables authentication for connections originated from the inside network to the outside network:

aaa authentication any outbound 192.168.1.0 255.255.255.0 204.31.17.0 255.255.255.0 tacacs+

This example enables authentication for connections originated from the inside network to the perimeter network:

aaa authentication any outbound 192.168.1.0 255.255.255.0 192.150.50.0 255.255.255.0 tacacs+

This example enables authentication for connections originated from the outside network to the inside network:

aaa authentication any inbound 192.168.1.0 255.255.255.0 204.31.17.0 255.255.255.0 tacacs+

This example enables authentication for connections originated from the outside network to the perimeter network:

aaa authentication any inbound 192.150.50.0 255.255.255.0 204.31.17.0 255.255.255.0 tacacs+

This example enables authentication for connections originated from the perimeter network to the outside network:

aaa authentication any perimeter 192.150.50.0 255.255.255.0 204.31.17.0 255.255.255.0 tacacs+

2. This example specifies that IP addresses 10.0.0.1 through 10.0.0.254 can originate outbound connections and then enables user authentication so that those addresses must enter user credentials to exit the firewall. In this example, the first aaa authentication command permits authentication on FTP, HTTP, or Telnet depending on what the authentication server handles. The second aaa authentication command lets host 10.0.0.42 start outbound connections without being authenticated.

nat (inside) 1 10.0.0.0 255.255.255.0
aaa authentication any outbound 0 0 tacacs+
aaa authentication except outb 10.0.0.42 255.255.255.255 tacacs+

3. This example permits inbound access to any IP address in the range of 204.31.17.1 through 204.31.17.254. All services are permitted by the conduit command and the aaa authentication command permits authentication on FTP, HTTP, or Telnet depending on what the authentication server handles.

static (inside, outside) 204.31.17.0 10.16.1.0 netmask 255.255.255.0 10 60
conduit permit tcp 204.31.17.0 255.255.255.0 10.16.1.0 255.255.255.0
aaa authentication any inbound 0 0 tacacs+

4. This example enables authorization for DNS lookups from the outside interface:

aaa authorization udp/53 inbound 0.0.0.0 0.0.0.0

5. This example enables authorization of ICMP echo-reply packets arriving at the inside interface from inside hosts:

 aaa authorization 1/0 outbound 0.0.0.0 0.0.0.0

This means that users will not be able to ping external hosts if they have not been authenticated using Telnet, HTTP, or FTP.

6. This example enables authorization for ICMP echoes (pings) only that arrive at the inside interface from an inside host:

aaa authorization 1/8 outbound 0.0.0.0 0.0.0.0

alias

Administer overlapping addresses with dual NAT. (Configuration mode.)

alias [(if_name)] dnat_ip foreign_ip [netmask]
no alias [[(if_name)] dnat_ip foreign_ip [netmask]]
show alias

Syntax Description


if_name	The internal network interface name in which the foreign_ip overlaps.
dnat_ip	An IP address on the internal network that provides an alternate IP address for the external address that is the same as an address on the internal network.
foreign_ip	IP address on the external network that has the same address as a host on the internal network.
netmask	Network mask applied to both IP addresses. Use 255.255.255.255 for host masks.

Usage Guidelines

The alias command translates one address into another. Use this command to prevent conflicts when you have IP addresses on a network that are the same as those on the Internet or another intranet. You can also use this command to do address translation on a destination address. For example, if a host sends a packet to 204.31.17.1, you can use alias to redirect traffic to another address, such as, 192.150.50.42.

After changing or removing an alias statement, use the clear xlate command. If the previous condition persists, save your configuration with the write memory command and then reboot the PIX Firewall.

There must be an A (address) record in the DNS zone file for the "dnat" address in the alias command.

The no alias command disables a previously set alias statement. The show alias command displays alias statements in the configuration.

The alias command automatically interacts with DNS servers on your network to ensure that domain name access to the aliased IP address is handled transparently.

You can specify a net alias by using network addresses for the foreign_ip and dnat_ip IP addresses. For example, alias 10.1.1.0 204.31.17.0 255.255.255.0 creates aliases for each IP address between 204.31.17.1 and 204.31.17.254.

Examples

1. In this example, an inside network uses IP address 192.159.1.33, which on the Internet belongs to domain.com. When inside clients try to access domain.com, the packets do not go to the firewall because the client thinks 192.159.1.33 is on the local inside network. To correct this, a net alias is created as follows with the alias command:

alias (inside) 192.168.1.0 192.159.1.0
 
show alias
alias 192.168.1.0 192.159.1.0 255.255.255.0

When client 192.159.1.123 connects to domain.com, the DNS response from an external DNS server to the internal client's query would be altered by the PIX Firewall to: 192.168.1.33. If the PIX Firewall uses 204.31.17.1 through 204.31.17.254 as the global pool IP addresses, the packet goes to the PIX Firewall with SRC=192.159.1.123 and DST=192.168.1.33. The PIX Firewall translates it to SRC=204.31.17.254 and DST=192.159.1.33 on the outside.

2. In this example, a web server is on the inside at 10.1.1.11 and a static for it at 204.31.17.11. The source host is on the outside with address 192.150.50.7. A DNS server on the outside has a record for www.caguana.com as follows:

www.caguana.com.

IN

A

204.31.17.11

www.caguana.com.		IN		A		204.31.17.11

The period at the end of the www.caguana.com. domain name must be included.

The alias command is:

alias 10.1.1.11 204.31.17.11 255.255.255.255

PIX Firewall doctors the nameserver replies to 10.1.1.11 for inside clients to directly connect to the web server.

The conduit command statement you would expect to use is:

conduit permit tcp host 204.31.17.11 eq telnet host 192.150.50.7

But with the alias command, use this command:

: conduit permit tcp host 204.31.17.11 eq telnet host 192.159.1.7
: You can test the DNS entry for the host with the following nslookup command:

nslookup -type=any www.caguana.com

arp

Change or view the PIX Firewall's ARP cache, and set the timeout value. (Configuration mode.)

arp if_name ip_address mac_address [alias]
clear arp
no arp if_name ip_address
show arp [if_name] [ip_address mac_address alias]
arp timeout seconds
no arp timeout
show arp timeout

Syntax Description


if_name	The internal or external interface name specified by the nameif command.
ip_address	IP address for the ARP table entry.
mac_address	Hardware MAC address for the ARP table entry; for example, 00e0.1e4e.3d8b.
alias	Make this entry permanent. Alias entries do not time out and are automatically stored in the configuration when you use the write command to store the configuration.
seconds	Duration that an ARP entry can exist in the ARP table before being cleared.

Usage Guidelines

The arp command adds an entry to the PIX Firewall ARP cache. ARP is a low-level TCP/IP protocol that resolves a node's physical address from its IP address through an ARP request asking the node with a particular IP address to send back its physical address. The presence of entries in the ARP cache indicates that the PIX Firewall has network connectivity. The clear arp command clears the ARP table but not the alias (permanent) entries. Use the no arp command to remove these entries. The show arp command lists the entries in the ARP table.

Use the arp command to add an entry for new hosts you add on your network or when you swap an existing host for another. Alternatively, you can wait for the duration specified with the arp timeout command to expire and the ARP table rebuilds itself automatically with the new host information.

The arp timeout command sets the duration that an ARP entry can stay in the PIX Firewall ARP table before expiring. The timer is known as the ARP persistence timer. The default value is
14,400 seconds (4 hours).

The no arp timeout command sets the timer to its default value. The show arp timeout command displays its current value.

Examples

arp inside 192.168.0.42 00e0.1e4e.2a7c
arp outside 192.168.0.43 00e0.1e4e.3d8b alias
show arp
outside 192.168.0.43 00e0.1e4e.3d8b alias
inside 192.168.0.42 00e0.1e4e.2a7c
 
clear arp inside 192.168.0.42
 
arp timeout 42
show arp timeout
arp timeout 42 seconds
 
no arp timeout
show arp timeout
arp timeout 14400 seconds

auth-prompt

Change the AAA challenge text. (Configuration mode.)

auth-prompt string
clear auth-prompt
no auth-prompt string
show auth-prompt

Syntax Description


string	A string of up to 256 alphanumeric characters. Special characters should not be used; however, spaces and punctuation characters are permitted. Entering a question mark or pressing the Enter key ends the string. (The question mark appears in the string.)

Usage Guidelines

The auth-prompt command lets you change the AAA challenge text for HTTP, FTP, and Telnet access. This text displays above the username and password prompts that users view when logging in. If you do not use this command, FTP users view FTP authentication, HTTP users view HTTP Authentication, and challenge text does not appear for Telnet access.

Example

auth-prompt XYZ Company Firewall Access

After this string is added to the configuration, users view:

XYZ Company Firewall Access
User Name:
Password:

conduit

Add, delete, or show conduits through the firewall for incoming connections. (Configuration mode.)

conduit permit|deny protocol global_ip global_mask [operator port [port]] foreign_ip foreign_mask [operator port [port]]
no conduit permit|deny protocol global_ip global_mask [operator port [port]] foreign_ip foreign_mask [operator port [port]]
conduit permit|deny icmp global_ip global_mask foreign_ip foreign_mask [icmp_type]
show conduit


permit	Permit access if the conditions are matched.
deny	Deny access if the conditions are matched.
protocol	Specify the transport protocol for the connection. Possible literal values are icmp, tcp, udp, or an integer in the range 0 through 255 representing an IP protocol number. Use ip to specify all transport protocols. You can view valid protocol numbers online at: http://www.isi.edu/in-notes/iana/assignments/protocol-numbers If you specify the icmp protocol, you can permit or deny ICMP access to one or more global IP addresses. Specify the ICMP type in the icmp_type variable, or omit to specify all ICMP types. Refer to the Usage Guidelines for a complete list of the ICMP types.
global_ip	A global IP address previously defined by a global or static command. You can use any if the global_ip and global_mask are 0.0.0.0 0.0.0.0. The any option applies the permit or deny to the global addresses. If global_ip is a host, you can omit global_mask by specifying the host command before global_ip. For example: conduit permit tcp host 204.31.17.1 eq ftp any This example lets any foreign host access global address 204.31.17.1 for FTP.
global_mask	Network mask of global_ip. The global_mask is a 32-bit, four-part dotted decimal; such as, 255.255.255.255. Use zeros in a part to indicate bit positions to be ignored. Use subnetting if required. If you use 0 for global_ip, use 0 for the global_mask; otherwise, enter the global_mask appropriate to global_ip.
foreign_ip	An external IP address (host or network) that can access the global_ip. You can specify 0.0.0.0 or 0 for any host. If both the foreign_ip and foreign_mask are 0.0.0.0 0.0.0.0, you can use the shorthand any option. If foreign_ip is a host, you can omit foreign_mask by specifying the host command before foreign_ip. For example: conduit permit tcp any eq ftp host 204.31.17.42 This example lets foreign host 204.31.17.42 access any global address for FTP.
foreign_mask	Network mask of foreign_ip. The foreign_mask is a 32-bit, four-part dotted decimal; such as, 255.255.255.255. Use zeros in a part to indicate bit positions to be ignored. Use subnetting if required. If you use 0 for foreign_ip, use 0 for the foreign_mask; otherwise, enter the foreign_mask appropriate to foreign_ip. You can also specify a mask for subnetting, for example, 255.255.255.192.
operator	A comparison operand that lets you specify a port or a port range. Use without an operator and port to indicate all ports; for example: conduit permit tcp any any Use eq and a port to permit or deny access to just that port. For example use eq ftp to permit or deny access only to FTP: conduit deny tcp host 192.168.1.1 eq ftp 204.31.17.1 Use lt and a port to permit or deny access to all ports less than the port you specify. For example, use lt 2025 to permit or deny access to the well known ports (1 to 1024): conduit permit tcp host 192.168.1.1 lt 1025 any Use gt and a port to permit or deny access to all ports greater than the port you specify. For example, use gt 42 to permit or deny ports 43 to 65535: conduit deny udp host 192.168.1.1 gt 42 host 204.31.17.42 Use neq and a port to permit or deny access to every port except the ports that you specify. For example, use neq 10 to permit or deny ports 1-9 and 11 to 65535: conduit deny tcp host 192.168.1.1 neq 10 host 204.31.17.42 neq 42 Use range and a port range to permit or deny access to only those ports named in the range. For example, use range 10 1024 to permit or deny access only to ports 10 through 1024. All other ports are unaffected. conduit deny tcp any range ftp telnet any Note By default, all ports are denied until explicitly permitted.
port	Service(s) you permit to be used while accessing global_ip or foreign_ip. Specify services by the port that handles it, such as smtp for port 25, www for port 80, and so on. You can specify ports by either a literal name or a number in the range of 0 to 65535. You can specify all ports by not specifying a port value; for example: conduit deny tcp any any This command is the default condition for the conduit command in that all ports are denied until explicitly permitted. You can view valid port numbers online at: http://www.isi.edu/in-notes/iana/assignments/port-numbers Refer to the "Ports" section in Chapter 1, "Introduction" for a list of valid port literal names in port ranges; for example, ftp h323. You can also specify numbers.
icmp_type	The type of ICMP message. Table 5-1 lists the ICMP type literals that you can use in this command. Omit this option to mean all ICMP types. An example of this command that permits all ICMP types is: conduit permit icmp any any. This command lets ICMP pass inbound and outbound.

Syntax Description

Usage Guidelines

A conduit statement creates an exception to the PIX Firewall Adaptive Security mechanism by permitting connections from one firewall network interface to access hosts on another.

The conduit command can permit or deny access to either the global or static commands; however, neither is required for the conduit command. You can associate a conduit command with a global or static command through the global address, either specifically to a single global address, a range of global addresses, or to all global addresses.

When used with a static, a conduit permits users on a lower security interface to access a higher security interface. When not used with a static, a conduit permits both inbound and outbound access.

If you associate a conduit with a static, only the interfaces specified on the static have access to the conduit. For example, if a static lets users on the dmz interface access the inside interface, only users on the dmz interface can access the static. Users on the outside do not have access.

Note The conduit commands are processed in the order entered into the configuration.

Conduit permit and deny options are processed in the order listed in the PIX Firewall configuration. In the following example host 192.159.1.250 is not denied access through the PIX Firewall because the permit option precedes the deny option:

conduit permit tcp host 204.31.17.4 255.255.255.255 eq 80 any
conduit deny tcp host 204.31.17.4 255.255.255.0 192.159.1.250 255.255.255.255 eq 80 any

Note If you want internal users to be able to ping external hosts, use the conduit permit icmp any any command.

After changing or removing a conduit command, use the clear xlate command. If the previous condition persists, save your configuration with the write memory command, and then reboot the PIX Firewall.

You can remove a conduit with the no conduit command. Use the show conduit command to view the conduit statements in the configuration.

If you prefer more selective ICMP access, you can specify a single ICMP message type as the last option in this command. Table 5-1 lists possible ICMP types values.

Table 5-1: ICMP Type Literals
ICMP Type Literal

0

echo-reply

3

unreachable

4

source-quench

5

redirect

6

alternate-address

8

echo

9

router-advertisement

10

router-solicitation

11

time-exceeded

12

parameter-problem

13

timestamp-reply

14

timestamp-request

15

information-request

16

information-reply

17

mask-request

18

mask-reply

31

conversion-error

32

mobile-redirect

**Table 5-1: ICMP Type Literals**
ICMP Type	Literal
0	echo-reply
3	unreachable
4	source-quench
5	redirect
6	alternate-address
8	echo
9	router-advertisement
10	router-solicitation
11	time-exceeded
12	parameter-problem
13	timestamp-reply
14	timestamp-request
15	information-request
16	information-reply
17	mask-request
18	mask-reply
31	conversion-error
32	mobile-redirect

Usage Notes

1. By default, all ports are denied until explicitly permitted.

2. Conduit commands are processed in the order entered in the configuration. If you remove a command, it affects the order of all subsequent conduit statements.

3. To remove all conduit commands, cut and paste your configuration onto your console computer, edit the configuration on the computer, use the write erase command to clear the current configuration, and then paste the configuration back into the PIX Firewall.

4. You can have as many conduits as needed as long as the total size of your configuration does not exceed 409,600 characters.

5. If you use PAT (Port Address Translation), you cannot use conduit using the PAT address to either permit or deny access to ports.

6. Two conduit statements are required for establishing access to the following services: discard, dns, echo, ident, pptp, rpc, sunrpc, syslog, tacacs-ds, talk, and time. Each service, except for pptp, requires one conduit for TCP and one for UDP. For DNS, if you are only receiving zone updates, you only need a single conduit statement for TCP.

The two conduit statements for the PPTP transport protocol, which is a subset of the GRE protocol, are as shown in this example:

static (dmz2,outside) 204.31.17.5 192.168.1.5 netmask 255.255.255.255
conduit permit tcp host 204.31.17.5 eq 1723 any
conduit permit gre host 204.31.17.5 any

In this example, PPTP is being used to handle access to host 192.168.1.5 on the dmz2 interface from users on the outside. Outside users access the dmz2 host using global address 204.31.17.5. The first conduit statement opens access for the PPTP protocol and gives access to any outside users. The second conduit permits access to GRE. If PPTP was not involved and GRE was, you could omit the first conduit statement.

7. The RPC conduit support fixes up UDP portmapper and rpcbind exchanges. TCP exchanges are not supported. This lets simple RPC-based programs work; however, remote procedure calls, arguments, or responses that contain addresses or ports will not be fixed up.

For MSRPC, two conduit statements are required, one for port 135 and another for access to the high ports (1024-65535). For Sun RPC, a single conduit is required for UDP port 111.

Once you create a conduit for RPC, you can use the following command to test its activity from a UNIX host:

rpcinfo -u unix_host_ip_address 150001

Replace unix-_host_ip_address with the IP address of the UNIX host.

8. You can overlay host statics on top of a net static range to further refine what an individual host can access:

static (inside, outside) 204.31.17.0 10.1.1.0
conduit permit tcp 204.31.17.0 255.255.255.0 eq ftp any
static (inside, outside) 203.31.17.3 10.1.1.3
conduit permit udp host 204.31.17.3 eq h323 host 1.2.3.3

In this case, the host at 1.2.3.3 has InternetPhone access in addition to its blanket FTP access.

Examples

1. The following commands permit access between an outside UNIX gateway host at 204.31.17.42, to an inside SMTP server with Mail Guard at 192.168.1.49. Mail Guard is enabled in the default configuration for PIX Firewall with the fixup protocol smtp 25 command. The global address on the PIX Firewall is 204.31.17.1:

static (inside,outside) 204.31.17.1 192.168.1.49 netmask 255.255.255.255 0 0
conduit permit tcp host 204.31.17.1 eq smtp host 204.31.17.42

To disable Mail Guard, enter this command:

no fixup protocol smtp 25

2. You can set up an inside host to receive H.323 InternetPhone calls and allow the outside network to connect inbound via the IDENT protocol (TCP port 113). In this example, the inside network is at 192.168.1.0, the global address is 204.31.17.0, and the outside network is 192.150.50.0:

static (inside,outside) 204.31.17.0 192.168.1.0 netmask 255.255.255.0 0 0
conduit permit tcp 204.31.17.0 255.255.255.0 eq h323 any
conduit permit tcp 204.31.17.0 255.255.255.0 eq 113 192.150.50.0 255.255.255.0

3. You can create a web server on the perimeter interface that can be accessed by any outside host as follows:

static (perimeter,outside) 204.31.17.4 192.168.1.4 netmask 255.255.255.0 0
conduit permit tcp host 204.31.17.4 eq 80 any

In this example, the static command maps the perimeter host, 10.1.1.4. to the global address, 204.31.17.4. The conduit statement specifies that the global host can be accessed on port 80 (web server) by any outside host.

configure

Clear or merge current configuration with that on floppy or Flash, start configuration mode, or view current configuration. (Privileged mode.)

clear configure primary|secondary|all
configure net [[server_ip]:[filename]]
configure floppy
configure memory
configure terminal
show configure

Syntax Description


clear	Clears aspects of the current configuration in RAM. Use the write erase command to clear the complete configuration.
primary	Sets the interface, ip, mtu, nameif, and route commands to their default values. In addition, interface names are removed from all commands in the configuration.
secondary	Removes the alias, apply, conduit, global, outbound, static, radius-server, tacacs-server, telnet, tftp-server, and url-server statements from your configuration.
net	Loads the configuration from a TFTP server and the path you specify.
all	Combines the primary and secondary options.
floppy	Merges the current configuration with that on diskette.
memory	Merges the current configuration with that in Flash memory.
terminal	Starts configuration mode to enter configuration commands from a terminal. Exit configuration mode by entering the quit command.
server_ip	Merges the current configuration with that available across the network at another location, which is defined with the tftp-server command.
filename	A filename you specify to qualify the location of the configuration file on the TFTP server named in server_ip. If you set a filename with the tftp-server command, do not specify it in the configure command; instead just use a colon (:) without a filename.

Usage Guidelines

The clear configure command resets a configuration to its default values. Use this command to create a template configuration or when you want to clear all values. The clear configure primary command resets the default values for the interface, ip, mtu, nameif, and route commands. This command also deletes interface names in the configuration. The clear configure secondary removes alias, conduit, global, and static lines from the configuration.

Note Save your configuration before using the clear configure command. The clear configure secondary command does not prompt you before deleting lines from your configuration.

The configure net command merges the current running configuration with a TFTP configuration stored at the IP address you specify and from the file you name. If you specify both the IP address and path name in the tftp-server command, you can specify :filename as simply a colon (:); for example:

	configure net :

Use the write net command to store the configuration in the file.

Note Many TFTP servers require the configuration file to be world-readable to be accessible.

The configure floppy command merges the current running configuration with the configuration stored on diskette. This command assumes that the diskette was previously created by the write floppy command.

The configure memory command merges the configuration in Flash memory into the current configuration in RAM.

The configure terminal command starts configuration mode. Exit configuration mode with the quit command. After exiting configuration mode, use write memory to store your changes in Flash memory or write floppy to store the configuration on diskette. Use the write terminal command to display the current configuration.

The show configure command lists the contents of the configuration in Flash memory.

Each statement from diskette (with configure floppy), Flash memory (with configure memory), or TFTP transfer (with configure net) is read into the current configuration and evaluated in the same way as commands entered from a keyboard with these rules:

If the command on diskette or Flash memory is identical to an existing command in the current configuration, it is ignored.
If the command on diskette or Flash memory is an additional instance of an existing command, such as if you already have one telnet command for IP address 1.2.3.4 and the diskette configuration has a telnet command for 6.7.8.9, then both commands appear in the current configuration.
If the command redefines an existing command, the command on diskette or Flash memory overwrites the command in the current configuration in RAM. For example, if you have hostname ram in the current configuration and hostname floppy on diskette, the command in the configuration becomes hostname floppy and the command line prompt changes to match the new host name when that command is read from diskette.

Example

configure net 10.1.1.1:/tftp/config/pixconfig
 
configure floppy
 
configure memory
 
pixfirewall> enable
password: *****
pixfirewall# configure terminal
pixfirewall(config)# show config
:Saved
... config commands ...
:End
 
write memory
clear configure primary
show global
global () 1 192.150.50.1-192.150.50.254 netmask 255.255.255.0
no global 1

debug

Debug packets or ICMP tracings through the PIX Firewall. (Configuration mode.)

debug icmp trace
no debug icmp trace
debug packet if_name [src source_ip [netmask mask]] [dst dest_ip [netmask mask]]
[[proto icmp]| [proto tcp [sport src_port] [dport dest_port]]|
[proto udp [sport src_port] [dport dest_port]] [rx|tx|both]
no debug packet if_name [src source_ip [netmask mask]] [dst dest_ip [netmask mask]]
[[proto icmp]|[proto tcp [sport src_port] [dport dest_port]]|
[proto udp [sport src_port] [dport dest_port]] [rx|tx|both]
debug sqlnet
no debug sqlnet
show debug

Syntax Description


if_name	Interface name from which the packets are arriving; for example, to monitor packets coming into the PIX Firewall from the outside, set if_name to outside.
src source_ip	Source IP address.
netmask mask	Network mask.
dst dest_ip	Destination IP address.
proto icmp	Display ICMP packets only.
proto tcp	Display TCP packets only.
sport src_port	Source port. Refer to the "Ports" section in Chapter 1, "Introduction" for a list of valid port literal names.
dport dest_port	Destination port.
proto udp	Display UDP packets only.
rx	Display only packets received at the PIX Firewall.
tx	Display only packets that were transmitted from the PIX Firewall.
both	Display both received and transmitted packets.

Usage Guidelines

The debug command lets you view debug information. The show debug command displays the current state of tracing. You can debug the contents of network layer protocol packets with debug packet. The debug sqlnet command reports on traffic between Oracle SQL*Net clients and servers through the PIX Firewall. The debug icmp trace command shows ICMP packet information, the source IP address, and the destination address of packets arriving, departing, and traversing the PIX Firewall including pings to the PIX Firewall's own interfaces.

Note Version 4.2(3) implements the new Trace Channel feature that changes where debug output appears. See the "Trace Channel Feature" section that follows for more information.

In version 4.2(2), you can only run and view displays of the debug commands from the PIX Firewall serial console.

Use of the debug commands can slow down busy networks.

Trace Channel Feature

In version 4.2(3), the debug command has changed so that the debug icmp trace and debug sqlnet commands now send their output to the Trace Channel. The location of the Trace Channel depends on whether you have a simultaneous Telnet console session running at the same time as the console session, or if you are using only the PIX Firewall serial console:

If you are only using the PIX Firewall serial console, all debug commands display on the serial console.

If you have both a serial console session and a Telnet console session accessing the console, then no matter where you enter the debug icmp trace or the debug sqlnet commands, the output displays on the Telnet console session.
If you have two or more Telnet console sessions, the first session is the Trace Channel. If that session closes, the serial console session become the Trace Channel. The next Telnet console session that accesses the console will then become the Trace Channel.
The debug packet command only displays on the serial console. However, you can enable or disable this command from either the serial console or a Telnet console sessions.

The debug commands are shared between all Telnet and serial console sessions.

Note The downside of the Trace Channel feature is that if one administrator is using the serial console and another administrator starts a Telnet console session, the serial console debug icmp trace and debug sqlnet output will suddenly stop without warning. In addition, the administrator on the Telnet console session will suddenly be viewing debug output, which may be unexpected. If you are using the serial console and debug output is not appearing, use the who command to see if a Telnet console session is running.

Additional debug Command Information

Note Use of the debug packet command on a PIX Firewall experiencing a heavy load may result in the output displaying so fast that it may be impossible to stop the output by entering the no debug packet command from the console. In version 4.2(3), you can enter the no debug packet command from a Telnet session. In version 4.2(2), the only recourse to stopping the output is to reboot the PIX Firewall.

Note To let users ping through the PIX Firewall, add the conduit permit icmp any any command to the configuration. This lets pings go outbound and inbound.

To stop a debug packet trace, enter:

no debug packet if_name

Replace if_name with the name of the interface; for example, inside, outside, or a perimeter interface name.

To stop a debug icmp trace, enter:

no debug icmp trace

Examples

The following example turns on this command:

debug icmp trace

When you ping a host through the PIX Firewall from any interface, trace output displays on the console. The following example shows a successful ping from an external host (204.31.17.42) to the PIX Firewall's outside interface (204.31.71.1):

Inbound ICMP echo reply (len 32 id 1 seq 256) 204.31.17.1 > 204.31.17.42
Outbound ICMP echo request (len 32 id 1 seq 512) 204.31.17.42 > 204.31.17.1
Inbound ICMP echo reply (len 32 id 1 seq 512) 204.31.17.1 > 204.31.17.42
Outbound ICMP echo request (len 32 id 1 seq 768) 204.31.17.42 > 204.31.17.1
Inbound ICMP echo reply (len 32 id 1 seq 768) 204.31.17.1 > 204.31.17.42
Outbound ICMP echo request (len 32 id 1 seq 1024) 204.31.17.42 > 204.31.17.1
Inbound ICMP echo reply (len 32 id 1 seq 1024) 204.31.17.1 > 204.31.17.42
NO DEBUG ICMP TRACE
ICMP trace off

This example shows that the ICMP packet length is 32 bytes, that the ICMP packet identifier is 1, and the ICMP sequence number. The ICMP sequence number starts at 0 and is incremented each time a request is sent.

You can debug the contents of packets with debug packet:

debug packet inside
--------- PACKET ---------
-- IP --
4.3.2.1 ==>     255.3.2.1
        ver = 0x4       hlen = 0x5      tos = 0x0       tlen = 0x60
        id = 0x3902     flags = 0x0     frag off=0x0
        ttl = 0x20      proto=0x11      chksum = 0x5885
        -- UDP --
                source port = 0x89      dest port = 0x89
                len = 0x4c      checksum = 0xa6a0
        -- DATA --
                00000014:                                     00 01 00 00|
          ....
                00000024: 00 00 00 01 20 45 49 45 50 45 47 45 47 45 46 46| ..
.. EIEPEGEGEFF
                00000034: 43 43 4e 46 41 45 44 43 41 43 41 43 41 43 41 43| CC
NFAEDCACACACAC
                00000044: 41 43 41 41 41 00 00 20 00 01 c0 0c 00 20 00 01| AC
AAA.. ..... ..
                00000054: 00 04 93 e0 00 06 60 00 01 02 03 04 00| ..
....\Q......
--------- END OF PACKET ---------

This display lists the information as it appears in a packet.

An example of show debug follows:

show debug
debug icmp trace off
debug packet off
debug sqlnet off

disable

Exit privileged mode and return to unprivileged mode. (Privileged mode.)

disable

Usage Guidelines

The disable command exits privileged mode and returns you to unprivileged mode. Use the enable command to return to privileged mode.

Example

pixfirewall# disable
pixfirewall>

enable

Start privileged mode. (Unprivileged mode.)

enable

Usage Guidelines

The enable command starts privileged mode. The PIX Firewall prompts you for your privileged mode password. By default, a password is not required---press the Enter key at the Password prompt to start privileged mode. Use disable to exit privileged mode. Use enable password to change the password.

Example

pixfirewall> enable
Password: 
pixfirewall# configure terminal
pixfirewall(config)#

enable password

Set the privileged mode password. (Privileged mode.)

enable password password [encrypted]
show enable password

Syntax Description


password	A case-sensitive password of up to 16 alphanumeric characters.
encrypted	Specifies that the password you entered is already encrypted. The password must be 16 characters in length.

Usage Guidelines

The enable password command changes the privileged mode password, for which you are prompted after you enter the enable command. When the PIX Firewall starts and you enter privileged mode, the password prompt appears. There is not a default password (press the Enter key at the Password prompt). The show enable password command lists the encrypted form of the password.

You can return the enable password to its original value (press the Enter key at prompt) by entering:

pixfirewall# enable password
pixfirewall#

Note If you change the password, write it down and store it in a manner consistent with your site's security policy. Once you change this password, you cannot view it again. Also, ensure that all who access the PIX Firewall console are given this password.

Use the passwd command to set the password for PIX Firewall Manager and Telnet access to the PIX Firewall console. The default passwd value is cisco.

Examples

pixfirewall> enable
Password:
pixfirewall# enable password w0ttal1fe
pixfirewall# configure terminal
write terminal
Building configuration...
...
enable password 2oifudsaoid.9ff encrypted
...

The following shows the use of the encrypted option:

enable password 1234567890123456 encrypted
show enable password
enable password 1234567890123456 encrypted
 
enable password 1234567890123456
show enable password
enable password feCkwUGktTCAgIbD encrypted

established

Allow or disallow return connections based on an established connection. (Configuration mode.)

established protocol dst_port_1 [permitto protocol [dst_port_2[-dst_port_2]]] [permitfrom protocol [src_port[-src_port]]]
no established protocol dst_port_1 [permitto protocol [dst_port_2[-dst_port_2]]] [permitfrom protocol [src_port[-src_port]]]
show established

Syntax Description


protocol	IP protocol type of udp or tcp.
dst_port_1	The destination port to which you want to establish a connection. Refer to the "Ports" section in Chapter 1, "Introduction" for a list of valid port literal names.
dst_port_2	The destination port that you want the PIX Firewall to permit the connection to return on.
src_port	The source port on the server from which the return connection will originate.
permitto	Permit inbound connections to the specified port or protocol. This option only opens the destination port.
permitfrom	Permit inbound connections from the specified port or protocol. Used with the permitto option, the permitfrom option provides a more specific source port. If the permitfrom option is used by itself, it requests access from a specific port to any port.

Usage Guidelines

The established command allows outbound connections return access to the PIX Firewall on different ports from which the original connection originated from. This command works with two connections, an original connection outbound from a network protected by the PIX Firewall and a return connection from a server on an external host. The PIX Firewall finds dst_port_1 in its translation table and associates the established command information with the outbound translation. The outbound translation indicates the source and destination IP addresses.

The first protocol and port you specify is for the destination of the original connection. The permitto and permitfrom options refine the information you specify for the return connection.

Note Cisco recommends that you always specify the established command with the permitto and permitfrom options. Without these options, the use of the established command opens a security hole that can be exploited for attack of your internal systems. Refer to the "Security Problem" section that follows for more information.

The permitto option lets you specify a new protocol or port for the return connection at the PIX Firewall. The permitfrom option lets you specify a new protocol or port at the remote server. The no established command disables the established feature. The show established command shows the established commands in the configuration.

Note For the established command to work, the client must listen on the port specified with the permitto option.

You can use the established command with a PAT or a non-PAT global statement, as well as with the nat 0 statement (where there are no global statements).

The established command works as shown in the following format:

established A B permitto C D permitfrom E F

This command works as though it were written "For protocol A and port B, permit a connection back to the PIX Firewall through protocol C and port D, and, optionally, permit a return connection from the server over protocol E and port F."

For example:

established tcp 6060 permitto tcp 6061 permitfrom tcp 6059

In this case, a source connection starts using TCP port 6060. The PIX Firewall then lets the return connection come back in over TCP port 6061 from a server that is providing the same service at TCP port 6059.

For multimedia applications such as RealAudio, VDO, Xing, VocalTec, H.323, and CuSeeMe, PIX Firewall handles return packet access through the firewalls transparently. For other applications, such as Internet gaming, if the return packets do not return correctly and the application does not work, the established command provides an alternative functionality.

Security Problem

While this command is running, all UDP or TCP traffic is permitted between the client and server for the current TCP connection. This command only allows the host to which the inside client is connected to deliver UDP data or make high TCP port connections back to the client.

The established command can potentially open a large security hole in the PIX Firewall if not used with discretion. Whenever you use this command, if possible, also use the permitto and permitfrom options to indicate ports to which and from which access is permitted. Without these options, users outside the PIX Firewall can access any ports on servers behind the firewall that are accessible with the conduit and static commands.

The following example illustrates this problem:

static (inside,outside) 204.31.17.42 192.168.1.42 netmask 255.255.255.255 
conduit permit tcp host 204.31.17.42 eq http any
established tcp 0

In this example, inside host 192.168.1.42 can be accessed from the outside interface for Web access as permitted by the conduit statement. Because this is a web server (using the HTTP port), access permission is granted to any outside host. However, the established command modifies the effect of the conduit statement and lets any user access any port on the 192.168.1.42 server.

Examples

The following example occurs when a local host 10.1.1.1 starts a TCP connection on port 9999 to a foreign host 204.31.17.1. The example allows packets from the foreign host 204.31.17.1 on port 4242 back to local host 10.1.1.1 on port 5454:

established tcp 9999 permitto tcp 5454 permitfrom tcp 4242

The next example allows packets from foreign host 204.31.17.1 on any port back to local host 10.1.1.1 on port 5454:

established tcp 9999 permitto tcp 5454

exit

Exit an access mode. (All modes.)

exit

Usage Guidelines

Use the exit command to exit from an access mode. This command is the same as quit.

Example

pixfirewall(config)# exit
pixfirewall# exit
pixfirewall>

failover

Change or view access to the optional failover feature. (Configuration mode.)

failover [active]
failover ip address if_name ip_address
failover reset
failover timeout hh:mm:ss
no failover active
show failover

Syntax Description


active	Make a PIX Firewall the Active unit. Use this command when you need to force control of the connection back to the unit you are accessing, such as when you want to switch control back from a unit after you have fixed a problem and want to restore service to the Primary unit. Either enter no failover active on the secondary unit to switch service to the primary or failover active on the Primary unit.
if_name	Interface on which the Standby unit resides.
ip_address	The IP address used by the Standby unit to communicate with the Active unit. Use this IP address with the ping command to check the status of the Standby unit. This address must be on the same network as the system IP address. For example, if the system IP address is 192.159.1.3, set the failover IP address to 192.159.1.4.
reset	Force both units back to an unfailed state. Use this command once the fault has been corrected. The failover reset command can be entered from either unit, but it is best to always enter commands at the Active unit. Entering the failover reset command at the Active unit will "unfail" the Standby unit.
timeout hh:mm:ss	Set the interval of time during which the secondary PIX Firewall admits all inbound and outbound traffic so that it can establish a translation slot table (xlates) for the traffic moving through the PIX Firewall. Once the xlates are created, the PIX Firewall resumes adaptive security. The effect of this feature is that stateful failover occurs after the 45 seconds required to allow the secondary unit to take over after the Primary unit fails. Because this duration is within the time in which a connection retries before being dropped, the failover will appear transparent to inbound and outbound users. Cisco recommends that the timeout value be set at 2 minutes or less. By default, this option is disabled. Note During the timeout interval, the PIX Firewall is placed in a non-secure state so that any host on the outside can access any inside host without requiring a conduit or static statement. Only use the timeout option with a static command containing the norandomseq option.

Usage Guidelines

Use the failover command without an argument after you connect the optional failover cable between your primary firewall and a secondary firewall. The default configuration has failover enabled. Enter no failover in the configuration file for the PIX Firewall if you will not be using the failover feature. Use the show failover command to verify the status of the connection and to determine which unit is active.

Note Remove the failover cable before upgrading to a new version of PIX Firewall. Once the new software is installed, reconnect the cable and reboot the two systems. The Primary unit will then automatically update the Secondary unit.

The Standby unit must not be configured individually. Only use the default configuration initially. When the two units are connected and the Primary unit reboots, the Secondary unit will be automatically updated. You can force an update by using the write standby command. If you make changes to the Standby unit, it displays a warning but does not update the Active unit.

To take a unit out of the "failed" state, cycle the power or use the failover reset command. When a failed Primary unit is fixed and brought back on line it will not automatically resume as the Active unit. This ensures that active control will not resume on a unit that could immediately enter a failed state again. However, if a failure is due to a lost signal on a network interface card, failover will "auto-recover" when the network is available again.

Use the failover active command to initiate a failover switch from the Standby unit, or the no failover active command from the Active unit to initiate a failover switch. You can use this feature to return a failed unit to service, or to force an Active unit offline for maintenance. Because the Standby unit does not keep state information on each connection, all active connections will be dropped and must be re-established by the clients.

If a failover IP address has not been entered, show failover will display 0.0.0.0 for the IP address, and monitoring of the interfaces will remain in "waiting" state. A failover IP address must be set for failover to work.

Refer to the section "Configuring Firewall Units for Failover" in Chapter 3 "Advanced Configurations" for additional configuration information.

Usage Notes

1. Failover provides a mechanism for PIX Firewall to be redundant by allowing two identical units to serve the same functionality.

2. One PIX Firewall unit is considered the "primary" unit while the other is considered the "secondary" unit (determined by the failover cable). The Primary unit is also the Active unit by default, and it performs normal network functions while the backup unit (standby) only monitors, ready to take control should the Active unit fail.

3. PIX Firewall configurations using failover require a separate IP address for each network interface on the Standby unit. The system IP address is the address of the Active unit. When the show IP address command is executed on the Active unit, the current IP address is the same as the system IP address. When the show IP address command is executed on the Standby unit, the system IP address is the failover IP address configured for the Standby unit.

4. The two units must be running the same version of software (4.2 or later). Configuration replication will occur under the following conditions:

(a) When the Standby unit completes its initial bootup, the Active unit will replicate its entire configuration to the Standby unit.

(b) As commands are entered on the Active unit they are sent across to the Standby unit. (The commands are sent via the failover cable.)

5. When a failure or switch occurs syslog messages are generated indicating the cause of the failure.

6. Because configuration replication is automatic from the Active unit to the Standby unit, configuration changes should only be entered from the Active unit.

7. With PIX Firewall version 4.2, failover works in a switched environment.

If the unit is attached to a switch running spanning tree, this will take twice the forward delay time configured in the switch (typically 15 seconds) plus 30 seconds. This is because at bootup (and immediately following a failover event) the network switch will detect a temporary bridge loop.

When this bridge loop is detected, the switch will stop forwarding packets for the duration of the forwarding delay time. It will then enter "listen" mode for an additional forward delay time during which time the switch is listening for bridge loops but still not forwarding traffic (and thus not forwarding failover hello packets). After twice the forward delay time (30 seconds) traffic should resume. The PIX Firewall will remain in "waiting" mode until it hears two hello packets (1 every 15 seconds for a total of 30 seconds). During this time the PIX Firewall passes traffic, and will not fail the unit if it does not hear the hello packets. All other failover monitoring is still occurring (power, interface, and failover cable hello).

8. Failover also works with the FDDI interface. Note that Port-B is on the top of the FDDI card, and Port-A is on the bottom.

9. Failover works by passing control to the secondary unit should the Primary unit fail. For Ethernet, failover detection should occur within 30 to 45 seconds.

10. Assign different IP addresses to each PIX Firewall (with the ip address command).

11. The failover feature causes the PIX Firewall to ARP for itself every 15 seconds. If this adversely affects your ARP table, you can disable it with the no failover command.

12. Failover will not start monitoring the network interfaces until it has heard the second hello packet from the other unit on that interface. This should happen within 30 to 60 seconds.

Examples

The following output shows that failover is enabled, and that the Primary unit state is active:

show failover
	Failover On
Cable status: Normal
        This host: Primary - Active
                Active time: 42855 (sec)
                Interface dmz (10.2.3.1): Normal (Waiting)
                Interface outside (204.31.17.1): Normal (Waiting)
                Interface inside (192.168.1.1): Normal (Waiting)
        Other host: Secondary - Standby
                Active time: 0 (sec)
                Interface dmz (10.2.3.2): Normal (Waiting)
                Interface outside (204.31.17.2): Normal (Waiting)
                Interface inside (192.168.1.2): Normal (Waiting

Waiting indicates that monitoring the other unit's network interfaces has not yet started. When a PIX Firewall fails, the Normal message changes to Failed.

You can view the IP addresses of the Standby unit with the show ip address command:

show ip address
System IP Addresses:
        ip address outside 204.31.17.2 255.255.255.0
        ip address inside 192.168.2.1 255.255.255.0
        ip address perimeter 204.31.18.3 255.255.255.0
Current IP Addresses:
        ip address outside 204.31.17.2 255.255.255.0
        ip address inside 192.168.2.1 255.255.255.0
        ip address perimeter 204.31.18.3 255.255.255.0

The Current IP Addresses are the same as the System IP Addresses on the failover Active unit. When the Primary unit fails, the Current IP Addresses become those of the Standby unit.

filter

Enable or disable outbound URL filtering for use with WebSENSE servers. (Configuration mode.)

filter url http|except local_ip local_mask foreign_ip foreign_mask [allow]
no filter url http|except [local_ip local_mask foreign_ip foreign_mask]
show filter

Syntax Description


url	Filter URLs (Universal Resource Locators) from data moving through the PIX Firewall.
http	Filter HTTP (World Wide Web) URLs.
except	Create an exception to a previous filter condition.
local_ip	The IP address of the highest security level interface from which access is sought. You can set this address to 0.0.0.0 (or in shortened form, 0) to specify all hosts.
local_mask	Network mask of local_ip. You can use 0.0.0.0 (or in shortened form, 0) to specify all hosts.
foreign_ip	The IP address of the lowest security level interface to which access is sought. You can use 0.0.0.0 (or in shortened form, 0) to specify all hosts.
foreign_mask	Network mask of foreign_ip. Always specify a specific mask value. You can use 0.0.0.0 (or in shortened form, 0) to specify all hosts.
allow	When the server is unavailable, let outbound connections pass through PIX Firewall without filtering. If you omit this option, and if the WebSENSE server goes offline, PIX Firewall stops outbound port 80 (Web) traffic until the WebSENSE server is back online.

Usage Guidelines

This command lets you prevent users from accessing World Wide Web URLs that you designate using the WebSENSE filtering application.

The allow option to the filter command determines how the PIX Firewall behaves in the event that the WebSENSE server goes offline. If you use the allow option with the filter command and the WebSENSE server goes offline, port 80 traffic passes through the PIX Firewall without filtering. Used without the allow option and with the server offline, PIX Firewall stops outbound port 80 (Web) traffic until the server is back online.

To filter URLs:

Step 1 Designate a WebSENSE server with the url-server command.

Step 2 Enable filtering with the filter command.

Step 3 If needed, improve throughput with the url-cache command. However, this command does not update WebSENSE logs, which may affect WebSENSE accounting reports. Accumulate WebSENSE run logs before using the url-cache command.

Step 4 Use the show url-cache stats and the show perfmon commands to view run information.

Information on WebSENSE is available at: http://www.websense.com/products/websense/

Example

The following example filters all outbound HTTP connections except those from the 10.0.2.54 host:

url-server (perimeter) host 10.0.1.1
filter url http 0 0 0 0
filter url except 10.0.2.54 255.255.255.255 0 0

fixup protocol

Change, enable, disable, or list a PIX Firewall application protocol feature. (Configuration mode.)

fixup protocol ftp [port]
fixup protocol http [port[-port]
fixup protocol h323 [port[-port]]
fixup protocol rsh [514]
fixup protocol smtp [port[-port]]
fixup protocol sqlnet [port[-port]]
no fixup protocol protocol [port[-port]]
show fixup [protocol protocol]

Syntax Description


protocol	Specify the protocol to fix up: ftp, http, h323, rsh, smtp, sqlnet.
port	Specify the port number or range for the application protocol. The default ports are: 80 for http, 1720 for h323, 25 for smtp, and 1521 for sqlnet. The default port value for rsh cannot be changed, but additional port statements can be added. Refer to the "Ports" section in Chapter 1, "Introduction" for a list of valid port literal names. In version 4.2(2), the FTP port cannot be changed; in version 4.2(3), it can.

Usage Guidelines

The fixup protocol commands let you view, change, enable, or disable the use of a through the PIX Firewall. The ports you specify are those that the PIX Firewall listens at for each respective service. You can change the port value for each service except rsh.

The fixup protocol smtp command enables the Mail Guard feature, which only lets mail servers receive the RFC 821, section 4.5.1 commands of HELO, MAIL, RCPT, DATA, RSET, NOOP, and QUIT. All other commands are rejected with the "500 command unrecognized" reply code.

The fixup protocol commands are always present in the configuration and are enabled by default. You can add multiple port settings for each protocol with separate commands; for example:

fixup protocol ftp 21
fixup protocol ftp 4254
fixup protocol ftp 9090

These commands cause PIX Firewall to listen to the standard FTP port of 21 but also to listen for FTP traffic at ports 4254 and 9090.

The show fixup command lists all values or the show fixup protocol protocol command lists an individual protocol.

You can disable a protocol definition with the no fixup command.

Examples

The following example enables access to an inside server running Mail Guard:

static (inside, outside) 204.31.17.1 192.168.42.1 netmask 255.255.255.0
conduit permit tcp host 204.31.17.1 eq smtp any
fixup protocol smtp 25

This example shows the default fixup protocol values:

show fixup
fixup protocol ftp 21
fixup protocol http 80
fixup protocol smtp 25
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol sqlnet 1521

The following example shows the commands to disable Mail Guard:

static (dmz1,outside) 204.31.17.1 10.1.1.1 netmask 255.255.255.255
conduit permit tcp host 204.31.17.1 eq smtp any
no fixup protocol smtp 25

In this example, the static command sets up a global address to permit outside hosts access to the 10.1.1.1 mail server host on the dmz1 interface. (The MX record for DNS needs to point to the 204.31.17.1 address so that mail is sent to this address.) The conduit command lets any outside users access the global address through the SMTP port (25). The no fixup protocol command disables the Mail Guard feature.

floodguard

Enable or disable Flood Defender to protect against flood attacks. (Configuration mode.)

floodguard 0|1
show floodguard

Syntax Description


0	Use floodguard 0 to disable Flood Defender.
1	Use floodguard 1 to enable this feature.

Usage Guidelines

The floodguard command lets you reclaim PIX Firewall resources if the user authentication (uauth) subsystem runs out of resources. If an inbound or outbound uauth connection is being attacked or overused, the PIX Firewall will actively reclaim TCP user resources.

When the resources deplete, the PIX Firewall lists messages about it being out of resources or out of tcpusers.

If the PIX Firewall uauth subsystem is depleted, TCP user resources in different states are reclaimed depending on urgency in the following order:

1. Timewait

2. FinWait

3. Embryonic

4. Idle

The floodguard command is enabled by default.

Example

floodguard 1
show floodguard
floodguard 1

global

Create or delete entries from a pool of global addresses. (Configuration mode.)

global [(if_name)] nat_id global_ip[-global_ip] [netmask global_mask]
no global [(if_name)] nat_id [global_ip[-global_ip] [netmask global_mask]]
show global

Syntax Description


if_name	The external network interface name where you use these global addresses.
nat_id	A positive number shared with the nat command that groups the nat and global statements together. The valid ID numbers can be any positive number up to 2,147,483,647.
global_ip	One or more global IP addresses that the PIX Firewall shares among its connections. If the external network is connected to the Internet, each global IP address must be registered with the Network Information Center (NIC). You can specify a range of IP addresses by separating the addresses with a dash (-). If you specify a single IP address, Port Address Translation (PAT) occurs on that address, which permits a single IP address the ability to support up to 64,000 active xlate objects, with the number of simultaneous connections governed by your connection license.
netmask	Reserved word that prefaces the network global_mask variable.
global_mask	The network mask for global_ip.

Usage Guidelines

The global command defines a pool of global addresses. The global addresses in the pool provide an IP address for each outbound connection, and for those inbound connections resulting from outbound connections. Ensure that associated nat and global statements have the same nat_id.

After changing or removing a global statement, use the clear xlate command. If the previous condition persists, save your configuration with the write memory command and then reboot the PIX Firewall.

Use the no global command to remove access to a nat ID, or to a PAT address or address range within a nat ID. Use the show global command to view the global statements in the configuration.

Usage Notes

1. You can enable the PAT (Port Address Translation) feature by entering a single IP address with the global command. PAT lets multiple outbound sessions appear to originate from a single IP address. With PAT enabled, the firewall chooses a unique port number from the PAT IP address for each outbound connection. This feature is valuable when an Internet service provider cannot allocate enough unique IP addresses for your outbound connections. The IP addresses you specify for Port Address Translation cannot be in another global address pool.

2. PAT does not work with H.323 applications and caching nameservers.

3. PAT works with DNS, FTP and passive FTP, HTTP, mail, RPC, rshell, Telnet, URL filtering, and outbound traceroute.

4. Do not use Port Address Translation when multimedia applications need to be run through the firewall. Multimedia applications can conflict with port mappings provided by PAT.

5. In version 4.2(2), the Port Address Translation (PAT) feature did not work with IP data packets that arrived in reverse order. In version 4.2(3), this now works correctly.

6. IP addresses in the pool of global addresses specified with the global command require reverse DNS entries to ensure that all external network addresses are accessible through the PIX Firewall. To create reverse DNS mappings, use a DNS PTR record in the address-to-name mapping file for each global address. For more information on DNS, refer to DNS and BIND, by Paul Albitz and Cricket Liu, O'Reilly & Associates, Inc., ISBN 1-56592-010-4. Without the PTR entries, sites can experience slow or intermittent Internet connectivity and FTP requests that consistently fail. For example, if a global IP address is 204.31.17.1 and the domain for the PIX Firewall is pix.caguana.com, the PTR record would be:

1.17.31.204.in-addr.arpa. IN PTR pix.caguana.com.

7. The PIX Firewall allocates global IP addresses from the pool by starting at the end of the range you specify and working backward. In the following example, PIX Firewall starts with address 204.31.17.50, 204.31.17.49, and so on down to 204.31.17.40:

global (outside) 1 204.31.17.40-204.31.17.50

Always add a PAT to the start of the range (the lowest IP address); for example:

global (outside) 1 204.31.17.39

Then should addresses 204.31.17.40 through 204.31.17.50 be used up, PIX Firewall will assign the next connection to a port in 204.31.17.39.

Note When a PAT is augmenting a pool of global addresses, first the addresses from the pool are used. The next connection is taken from the PAT address. If a global pool address frees, the next connection is taken from the global pool. The global pool addresses always come first, then the PAT addresses.

Examples

The following example declares two global pool ranges and a Port Address Translation address. Then the nat command permits all inside users to start connections to the outside network.

global (outside) 1 204.31.17.1-204.31.17.10 netmask 255.255.255.0
global (outside) 1 204.31.17.42 netmask 255.255.255.0
Global 204.31.17.42 will be Port Address Translated
nat (inside) 1 0 0
clear xlate

The next example creates a global pool from two contiguous Class C addresses and gives the perimeter hosts access to this pool of addresses:

global (outside) 1000 192.150.50.1-192.150.50.254
global (outside) 1000 192.150.51.1-192.150.51.254
nat (perimeter) 1000 0 0

help

Display help information. (Unprivileged mode.)

help
?

Usage Guidelines

The help or ? command displays help information about all commands. You can view help for an individual command by entering the command name followed by a question mark or just the command name and pressing the Enter key.

If the pager command is enabled and when 24 lines display, the listing pauses, and the following prompt appears:

<--- More --->

The More prompt uses syntax similar to the UNIX more command:

To view another screenful, press the Space bar.
To view the next line, press the Enter key.
To return to the command line, press the q key.

Example

age ?
age <minutes>

Help information is available on the core commands (not the show, no, or clear commands) by entering ? at the command prompt:

?
aaaEnable, disable, or view TACACS+ or RADIUS
user authentication, authorization and accounting
 
...

hostname

Change the host name in the PIX Firewall command line prompt. (Configuration mode.)

hostname newname

Syntax Description


newname	New host name for the PIX Firewall prompt. This name can be up to 16 alphanumeric characters and mixed case.

Usage Guidelines

The hostname command changes the host name label on prompts. The default host name is pixfirewall.

Example

pixfirewall(config# hostname spinner
spinner(config)# hostname pixfirewall
pixfirewall(config#

interface

Identify network interface speed and duplex. (Configuration mode.)

interface hardware_id hardware_speed
show interface

Syntax Description


hardware-_id	Identifies the network interface type. Possible values are ethernet0, ethernet1 to ethernetn token-ring0, token-ring1 to token-ringn, depending on how many network interfaces are in the firewall.
hardware_speed	Network interface speed. Possible Ethernet values are: 10baset---Set 10 Mbps Ethernet half duplex communications. 100basetx---Set 100 Mbps Ethernet half duplex communications. 100full---Set 100 Mbps Ethernet full duplex communications. aui---Set 10 Mbps Ethernet half duplex communications for an AUI cable interface. auto---Set Ethernet speed automatically. The auto keyword can only be used with the Intel 10/100 automatic speed sensing network interface card, which shipped with the PIX Firewall units manufactured after November 1996. bnc---Set 10 Mbps Ethernet half duplex communications for a BNC cable interface. Possible Token Ring values are: 4mbps---4 Mbps data transfer speed. You can specify this as 4. 16mbps---(default) 16 Mbps data transfer speed. You can specify this as 16.

Usage Guidelines

The interface command identifies the speed and duplex settings of the network interface boards.
Use show interface to view information about the interface.

The configuration of the interface affects buffer allocation (the PIX Firewall will allocate more buffers for higher line speeds). Buffer allocation can be checked with the show blocks command.

Note The show interface command reports "line protocol down" for BNC cable connections and for 3Com cards.

Usage Notes

1. When you use the interface token-ring command, also use the mtu command to set the block size depending on the interface speed.

2. After changing an interface command, save your configuration with the write memory command and then reboot the PIX Firewall.

show interface Notes

The show interface command lets you view network interface information for both Ethernet and Token Ring depending on which is installed in your PIX Firewall. This is one of the first commands you should use when establishing network connectivity after installing a PIX Firewall.

The information in the show interface display is as follows:

"ethernet" (or token-ring) indicates that you have used the interface command to configure the interface. The statement indicates either outside or inside and whether the interface is available ("up") or not available ("down").

"line protocol up" means a working cable is plugged into the network interface. If the message is "line protocol down," either the cable is incorrect or not plugged into the interface connector.
Network interface type.
Interrupt vector. It is acceptable for Token Ring and Ethernet cards to have the same interrupts because PIX Firewall uses interrupts to get Token Ring information, but polls Ethernet cards.
MAC address. Intel cards start with "i" and 3Com cards with "3c."
MTU (maximum transmission unit): the size in bytes that data can best be sent over the network.
"nn packets input" indicates that packets are being received in the firewall.
"nn packets output" indicates that packets are being sent from the firewall.
Line duplex status: half duplex indicates that the network interface switches back and forth between sending and receiving information; full duplex indicates that the network interface can send or receive information simultaneously.
Line speed: 10baseT is listed as 10000 Kbit; 100baseTX is listed as 100000 Kbit.
Interface problems:
- no buffer, the PIX Firewall is out of memory or slowed down due to heavy traffic and cannot keep up with the received data.
- runts are packets with less information than expected.
- giants are packets with more information than expected.
- CRC (cyclic redundancy check) are packets that contain corrupted data (checksum error).
- frame errors are framing errors.
- ignored and aborted errors are provided for future use, but are not currently checked; the PIX Firewall does not ignore or abort frames.
- underruns occur when the PIX Firewall is overwhelmed and cannot get data fast enough to the network interface card.
- overruns occur when the network interface card is overwhelmed and cannot buffer received information before more needs to be sent.

Example

The following example assigns names to each interface, enables auto detection for the interface parameters, and then shows interface activity:

nameif ethernet0 outside security0
nameif token-ring0 inside security100
nameif ethernet1 DMZ security50
interface ethernet0 auto
interface token-ring0 16mbps
interface ethernet1 auto
show interface
interface ethernet0 "outside" is up, line protocol is up
Hardware is rcpci45 ethernet, irq 10, address is 0060.7380.2f16
IP address 192.150.50.1, subnet mask 255.255.0.0
MTU 1500 bytes, BW 100000 Kbit half duplex
        0 packets input, 0 bytes, 0 no buffer
        Received 0 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        1 packets output, 0 bytes, 0 underruns
interface token-ring0 "inside" is up, line protocol is up
Hardware is o3137 token-ring, irq 9, address is 0000.8326.72c6
IP address 10.0.0.1, subnet mask 255.0.0.0
MTU 8192 bytes, BW 16000 Kbit, Ring-speed: 16Mbps
        116 packets input, 27099 bytes, 0 no buffer
        Received 116 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 116 frame, 0 overrun, 0 ignored, 0 abort
        3 packets output, 150 bytes, 0 underruns
interface ethernet1 "DMZ" is up, line protocol is up
Hardware is i82557 ethernet, irq 9, address is 00a0.c95d.0282
IP address 127.0.0.1, subnet mask 255.255.255.0
MTU 1500 bytes, BW 10000 Kbit half duplex
        0 packets input, 0 bytes, 0 no buffer
        Received 0 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 packets output, 0 bytes, 0 underruns

ip address

Identify the IP address for the PIX Firewall. (Configuration mode.)

ip address if_name ip_address [netmask]
show ip

Syntax Description


if_name	The internal or external interface name designated by the nameif command.
ip_address	PIX Firewall's network interface IP address.
netmask	Network mask of ip_address.

Usage Guidelines

The ip address command assigns an IP address to the PIX Firewall. Use the show ip command to view which addresses are assigned to the network interfaces. If you make a mistake while entering this command, re-enter the command with the correct information.

After changing an ip address command, save your configuration with the write memory command and then reboot the PIX Firewall.

Note Do not set the netmask to all 255s, such as 255.255.255.255. This stops access on the interface. Instead, use a network address of 255.255.255.0 for Class C addresses, 255.255.0.0 for Class B addresses, or 255.0.0.0 for Class A addresses.

The default address for an interface is 127.0.0.1.

PIX Firewall configurations using failover require a separate IP address for each network interface on the Standby unit. The system IP address is the address of the Active unit. When the show IP address command is executed on the Active unit, the current IP address is the same as the system IP address. When the show IP address command is executed on the Standby unit, the system IP address is the failover IP address configured for the Standby unit.

Example

nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 perimeter security50
ip address inside 192.168.2.1 255.255.255.0
ip address outside 204.31.17.2 255.255.255.0
ip address perimeter 204.31.18.3 255.255.255.0
show ip address
System IP Addresses:
        ip address outside 204.31.17.2 255.255.255.0
        ip address inside 192.168.2.1 255.255.255.0
        ip address perimeter 204.31.18.3 255.255.255.0
Current IP Addresses:
        ip address outside 204.31.17.2 255.255.255.0
        ip address inside 192.168.2.1 255.255.255.0
        ip address perimeter 204.31.18.3 255.255.255.0

The Current IP Addresses are the same as the System IP Addresses on the failover Active unit. When the Primary unit fails, the Current IP Addresses become those of the Standby unit.

kill

Terminate a Telnet session. (Privileged mode.)

kill telnet_id

Syntax Description


telnet_id	Telnet session ID.

Usage Guidelines

The kill command terminates a Telnet session. Use the who command to view the Telnet session ID value. When you kill a Telnet session, the PIX Firewall lets any active commands terminate and then drops the connection without warning the user. The kill command does not affect PIX Firewall Manager sessions.

Example

show who
2: From 10.10.54.0 
kill 2

link/linkpath/age

Specify a Private Link connection to a remote PIX Firewall. (Configuration mode.)

link [(if_name)] foreign_external_ip key-id key|md5
no link [(if_name)] foreign_external_ip key-id key|md5
show link
linkpath foreign_internal_ip netmask foreign_external_ip
no linkpath foreign_internal_ip netmask foreign_external_ip
show linkpath
age minutes
show age

Syntax Description


if_name	Allow a Private Link tunnel to terminate on an interface other than the inside, which was previously the only option. This feature allows connections to pass through the PIX Firewall's Adaptive Security and be translated before connecting through Private Link.
foreign_external_ip	The external network interface IP address on the foreign PIX Firewall running Private Link. This address cannot be 0.0.0.0.
foreign_internal_ip	The internal network IP address on the foreign PIX Firewall running Private Link. Note that this is the IP address of the network on the inside of the PIX Firewall, not the address of the inside interface.
key-id	A value from 1 to 7.
key	The 56-bit key (up to 14 hexadecimal digits) used to seed the encryption chip. This key must be the same on each host end of an encrypted link. The key consists of hexadecimal numbers; for example, fadebacfadebac. Select a unique key that is difficult to guess. Do not use the example keys shown in this document.
md5	Select MD5 authentication. This option puts an MD5 digital signature in the AH/ESP header of each packet before being transmitted to the remote Private Link firewall.
netmask	Specifies a subnet mask to apply to foreign_internal_ip.
minutes	age only: Duration in minutes that a Private Link key is used to encrypt information on the connection. The maximum duration is 130,000,000 minutes (247 years). The minimum duration is 1 minute.

Usage Guidelines

The link command creates an encrypted path between version 4.2(x) Private Link-equipped PIX Firewall units. The PIX Firewall Private Link consists of an encryption circuit board and software that permits the PIX Firewall units to provide encrypted communications across an unsecure network such as the Internet.

You can specify up to seven encryption keys for data access between your unit and the remote unit. The key-ID and key values must be the same on each side of the Private Link. Once you specify the same keys on both sides of the connection, the systems alert each other when a new key takes effect.

PIX Firewall selects the next Private Link encryption key by the "round-robin" method. The age command determines the length of time a key is current.

The no link command deletes a key from the link command. Use the show link command to list the remote IP address, keys, and the number of packets processed through Private Link.

The linkpath command identifies the internal and external network interfaces on the foreign PIX Firewall running Private Link. Use show linkpath to view the IP addresses you specify. Use no linkpath to stop access to a Private Link remote firewall. You can use multiple linkpath statements to define which networks on the remote PIX Firewall can access the Private Link connection.

The show age command lists the current aging duration.

Usage Notes

1. Both PIX Firewall units using Private Link must run the same software version. Private Link on PIX Firewall version 4.2(x) does not operate with Private Link on PIX Firewall
version 4.1(x).

2. After using the link command to add or delete link entries, use the write memory command to store the configuration, and then reboot the PIX Firewall.

3. The number of Private Link keys must be the same on both sides of the link.

4. If you use the link command to change the interface on which a Private Link tunnel terminates, you must reboot the PIX Firewall on which you made the change. For example, if the Private Link tunnel terminates on the perimeter interface of the foreign PIX Firewall and you change it to terminate on the inside interface of the foreign PIX Firewall, you must reboot the local PIX Firewall on which you changed the configuration.

5. You can use the linkpath 0.0.0.0 0.0.0.0 foreign_external_ip command to route all outbound traffic on a foreign PIX Firewall to a central PIX Firewall. However, this use has two caveats: there can be only one central PIX Firewall and the other PIX Firewall units must be satellites to it. This implies that the satellites only relay connections to the central and do not communicate among themselves. The second caveat is that the linkpath 0 0 command overrides the default route on the outside interface of the satellite PIX Firewall causing all outbound traffic to flow over Private Link to the central PIX Firewall unit. One use of this feature is when access to the Internet is controlled through one PIX Firewall and the other PIX Firewall units feed their Internet traffic to this one site. This could occur when a central processing facility wants to manage all the Internet IP addresses, let the internal networks use any IP numbering scheme, and have local PIX Firewall units protecting individual departments or sites.

6. Use of linkpath from a perimeter interface requires a route command for that interface. Refer to the "Examples" section for more information.

7. You cannot ping the PIX Firewall interfaces from either the local or foreign PIX Firewall units. Use hosts on the network to ensure that PIX Firewall interfaces are reachable.

8. Test access to the foreign Private Link PIX Firewall with the ping inside command.

9. An encryption circuit board must be present to use link or linkpath commands.

10. Private Link is enabled automatically after you power-up after inserting the encryption circuit board.

11. If you install the Private Link board after you purchase your PIX Firewall, Refer to the Regulatory Compliance and Safety Information for the PIX Firewall for important safety information before opening the PIX Firewall chassis. Then refer to the Quick Installation Guide for the PIX Firewall for information about opening the PIX Firewall chassis and inserting new boards. Both documents are provided in the PIX Firewall accessory kit, on the CCO Documentation CD-ROM, and at the www.cisco.com web site.

12. Enter the link command for each key you want to specify; for example, if you want seven keys, enter the link command in the configuration seven times.

13. The PIX Firewall allows up to 256 Private Links.

14. At least two PIX Firewall units are required along with the hardware/software option to use this feature.

15. Refer to "Private Link" in Chapter 3 "Advanced Configurations" for more information.

16. If a single key is set, the age command keeps that one key active continuously.

17. Use the same link statements on either side of the Private Link to ensure that the keys are the same and in the same order on both sides of the link.

18. Private Link packet information tells the remote side what key number to use to decrypt the data. The aging duration can be different, as well as the system clocks themselves on either side of the link, but as long as you use the same link statements on both sides, all information decrypts correctly.

Examples

The following example specifies the remote IP address of the Private Link and specifies four keys for access to the remote system, and specifies the IP address of the inside network interface on the remote host.

link (perimeter) 204.31.17.2 1 fadebacfadebac
link (perimeter) 204.31.17.2 2 bacfadefadebac
link (perimeter) 204.31.17.2 3 baabaaafadebac
link (perimeter) 204.31.17.2 4 beebeeefadebac
linkpath 10.1.1.0 255.255.255.0 204.31.17.2
route perimeter 10.1.1.0 255.255.255.0 192.150.50.1 1

The link and linkpath commands in this example allow a Private Link to be established to or from the perimeter network at 204.31.17.2 and the remote network at 10.1.1.0. The route command is required to force the Private Link communications to the perimeter interface. The 192.150.50.1 IP address is that of the PIX Firewall's perimeter interface.

Another example follows:

link 204.31.17.42 1 12345678901234
show link
TermIfaceForeign IPKeyIDKey
inside204.31.17.4210x12345678901234

An age example follows:

age 10
show age
Private Link Key Aging: 10 minutes

logging

Enable or disable syslog and SNMP logging. (Replaces the syslog commands.) (Configuration mode.)

logging on
logging buffered level
clear logging
logging console level
logging facility facility
logging host [in_if_name] ip_address
logging monitor level
logging trap level
no logging command
show logging

Syntax Definition


on	Start sending syslog messages to all output locations. Stop all logging with the no logging on command.
buffered	Send syslog messages to an internal buffer that can be viewed with the show logging command. Use the clear logging command to clear the message buffer. New messages append to the end of the buffer.
console	Specify that syslog messages appear on the PIX Firewall console as each message occurs. You can limit the types of messages that appear on the console with level. Cisco recommends that you do not use this command in production mode because its use degrades PIX Firewall performance.
facility	Specify the syslog facility. The default is 20.
host	Specify a syslog server that will receive the messages sent from the PIX Firewall. You can use multiple logging host commands to specify additional servers that would all receive the syslog messages.
monitor	Specify that syslog messages appear on Telnet sessions to the PIX Firewall console.
trap	Start sending syslog messages to a syslog server and SNMP traps to an SNMP server.
clear	Clear the buffer for use with the logging buffered command.
show	List which logging options are enabled. If the logging buffered command is in use, the show logging command lists the current message buffer.
in_if_name	Interface on which the syslog server resides.
ip_address	Syslog server's IP address.
command	A logging command: buffered, console, facility, host, monitor, or trap.
level	Specify the syslog message level as a number or string. The level you specify means that you want that level and those less than the level. For example, if level is 3, syslog displays 0, 1, 2, and 3 messages. Possible number and string level values are: · 0---emergencies---System unusable messages · 1---alerts---Take immediate action · 2---critical---Critical condition · 3---errors---Error message · 4---warnings---Warning message · 5---notifications---Normal but significant condition · 6---informational---Information message · 7---debugging---Debug messages and log FTP commands and WWW URLs
facility	Eight facilities LOCAL0(16) through LOCAL7(23); the default is LOCAL4(20). Hosts file the messages based on the facility number in the message.

Usage Guidelines

The logging command lets you enable or disable sending informational messages to the console, to a syslog server, or to an SNMP server. Refer to the System Log Messages for the PIX Firewall guide online at:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v42/syslog/index.htm

Note Do not use the logging console command when the PIX Firewall is in production mode because it degrades system performance. By default, this command is disabled. Instead, use the logging buffered command to start logging, the show logging command to view the messages, and the clear logging command to clear the buffer to make viewing the most current messages easier.

Note PIX Firewall provides more information in messages sent to a syslog server than at the console, but the console provides enough information to permit effective troubleshooting.

Viewing Syslog Messages from the Console

To view syslog messages from the PIX Firewall console:

Step 1 Store syslog messages for display at the PIX Firewall console with the following command:

logging buffered 7

The value 7 stores all syslog messages. If preferred, set the value to a lower number to view fewer messages. Refer to Appendix A of the System Log Messages for the PIX Firewall guide for a list of messages that appear at each severity level.

Step 2 View the messages with:

show logging

Step 3 Use the clear logging command to clear the buffer so that viewing new messages is easier.

Step 4 To disable storing messages, use the no logging buffered command.

New messages appear at the end of the logging listing.

Viewing Syslog Messages from a Telnet Console Session

To view syslog messages from a Telnet console session:

Step 1 If you have not done so already, configure the PIX Firewall to let a host on the inside interface access the PIX Firewall with the telnet command. For example, if a host has the IP address 192.168.1.2, the command would be:

telnet 192.168.1.2 255.255.255.255

You should also set the duration that a Telnet session can be idle before PIX Firewall disconnects the session to a value greater than the default of 5 minutes. A good value is at least 15 minutes, which you can set as follows:

telnet timeout 15

Step 2 Start Telnet and specify the inside interface of the PIX Firewall. For example, if the inside interface of the PIX Firewall is 192.168.1.1, the command to start Telnet would be:

telnet 192.168.1.1

Step 3 When Telnet connects, the PIX Firewall prompts you with the PIX passwd: prompt. Enter the Telnet password, which is cisco by default.

Step 4 Use the enable command followed by the configure terminal command to get to configuration mode.

Step 5 Start message logging with the logging monitor command.

Step 6 Display messages directly to the Telnet session by entering the terminal monitor command. You can disable directly displaying messages by entering the terminal no monitor command.

Step 7 Trigger some events by pinging a host or starting a web browser. The syslog messages then appear in the Telnet session window.

Step 8 When done, disable this feature with these commands:

terminal no monitor
no logging monitor

Sending Syslog Messages to a Syslog Server

To send messages to a syslog server:

Step 1 Designate a host to receive the messages with the logging host command as shown in the following example:

logging host dmz1 192.168.1.5

You can specify additional servers so that should one go offline, another will be available to receive messages.

Step 2 Set the logging level with the logging trap command; for example:

logging trap debugging

Cisco recommends that you use the debugging level during initial setup and during testing. Thereafter, set the level from debugging to errors for production use.

Step 3 If needed, set the logging facility command to a value other than its default of 20. Most UNIX systems expect the messages to arrive at facility 20.

Step 4 Start sending messages with the logging on command. To disable sending messages, use the no logging on command.

In the event that all syslog servers are offline, PIX Firewall stores up to 100 messages in its memory. Subsequent messages that arrive overwrite the buffer starting from the first line.

Sending SNMP Traps to an SNMP Server

To send traps to an SNMP server:

Step 1 Identify the IP address of the SNMP server with the snmp-server host command.

Step 2 Set the snmp-server options for location, contact, and the community password as required.

Step 3 Set the logging level with the logging trap command; for example:

logging trap debugging

Cisco recommends that you use the debugging level during initial set up and during testing. Thereafter, set the level from debugging to errors for production use.

Step 4 Start sending syslog messages to the server with the logging on command. To disable sending messages, use the no logging on command.

Only syslog messages in the syslog MIB are controlled by this command. Refer to "Compiling Cisco Syslog Enterprise MIB Files" in Chapter 3, "Advanced Configurations" for more information.

Additional logging Command Information

The PIX Firewall generates syslog messages for system events, such as security alerts and resource depletion. Using a UNIX syslog facility, you can specify which types of syslog messages create email alerts, are stored in log files, or display on the console of a designated inside network host. Use the logging monitor command to determine what messages display in a Telnet session to the PIX Firewall console.

To disable messages for a specific session, use the terminal no monitor command.

Because the PIX Firewall shares the eight facilities with other UNIX network devices, the logging facility command lets you choose the facility that the PIX Firewall marks on each message it sends to the syslog host. Messages are sent to the syslog host over UDP.

A PC WinSock version of syslogd can also receive syslog events created by PIX Firewall.

Use show logging to view the current syslog hosts and previously sent messages.

Example

The following example shows how to start console logging and view the results:

logging buffered debugging
show logging 
Syslog logging: enabled
    Console logging: disabled
    Monitor logging: disabled
    Buffer logging: level debugging, 37 messages logged
    Trap logging: disabled
305001: Portmapped translation built for gaddr 204.31.17.5/0 laddr 192.168.1.2/256
...

The line of output starting with 305001 shows a translation to a PAT global through global address 204.31.17.5 from a host at 192.168.1.2. The "305001" identifies a syslog message for creating a translation through a PAT global. Refer to the System Log Messages for the PIX Firewall for more information on syslog messages.

mtu

Specify the MTU (maximum transmission unit) for an interface. (Configuration mode.)

mtu if_name bytes
no mtu [if_name bytes]
show mtu

Syntax Description


if_name	The internal or external network interface name.
bytes	The number of bytes in the MTU, in the range of 64 to 65,535 bytes. The value specified depends on the type of network connected to the interface.

Usage Guidelines

The mtu command sets the size of data sent on a connection. Data larger than the MTU value is fragmented before being sent. The minimum value for bytes is 64 and the maximum is 65,535 bytes.

PIX Firewall supports the IP Path MTU Discovery mechanism, as defined in RFC 1191. IP Path MTU Discovery allows a host to dynamically discover and cope with differences in the maximum allowable maximum transmission unit (MTU) size of the various links along the path. Sometimes a router is unable to forward a datagram because it requires fragmentation (the packet is larger than the MTU you set for the interface), but the "don't fragment" (DF) bit is set. The network software sends a message to the sending host, alerting it to the problem. The host will have to fragment packets for the destination so that they fit the smallest packet size of all the links along the path.

For Ethernet interfaces, the default MTU is 1,500 bytes in a block, which is also the maximum. This value is sufficient for most applications, but you can pick a lower number if network conditions warrant it.

For Token Ring, the default is 8,192 bytes.

The no mtu command resets the MTU block size to 1,500 for Ethernet interfaces and 8,192 for Token Ring. The show mtu command displays the current block size. The show interface command also shows the MTU value.

Example

interface token-ring0 16mbps
interface ethernet0 auto
mtu inside 8192
show mtu
mtu outside 1500
mtu inside 8192

name/names

Associate a name with an IP address. (Configuration mode.)

name ip_address name
no name [ip_address name]
names
no names
clear names
show names

Syntax Description


ip_address	The IP address of the host being named.
name	The name assigned to the IP address. Allowable characters are a to z, A to Z, 0 to 9, and an underscore. The name cannot start with a number. If the name is over 16 characters long, the name command fails.

Usage Guidelines

Use the name command to identify a host by a text name. The names you define become like a host table local to the PIX Firewall. Because there is no connection to DNS or /etc/hosts on UNIX servers, use of this command is a mixed blessing---it makes configurations much more readable but introduces another level of abstraction to administer; not only do you have to add and delete IP addresses to your configuration as you do now, but with this command, you need to ensure that the host names either match existing names or you have a map to list the differences.

The names command enables use of the name command to map text strings to IP addresses. The clear names and no names commands are the same and disable use of the name text strings. The show names command lists the name statements in the configuration.

Notes

1. You must first use the names command before using the name command. Use the name command immediately after the names command and before you use the write memory command.

2. To disable displaying name values, use no names.

3. Only one name can be associated with an IP address.

4. Both name and names statements are saved in the configuration.

Example

In the example that follows, the names command enables use of the name command. The name command substitutes pix-_inside for references to 192.168.42.3, and pix_outside for 204.31.17.33. The ip address commands use these names while assigning IP addresses to the network interfaces. The no names command disables the name values from displaying. Subsequent use of the names command restores their display.

names
name 192.168.42.3 pix_inside
name 204.31.17.33 pix_outside
ip address inside pix_inside
ip address outside pix_outside
show ip address
inside ip address pix_inside mask 255.255.255.255
outside ip address pix_outside mask 255.255.255.255
no names
show ip address
inside ip address 192.168.42.3 mask 255.255.255.255
outside ip address 204.31.17.33 mask 255.255.255.255
names
show ip address
inside ip address pix_inside mask 255.255.255.255
outside ip address pix_outside mask 255.255.255.255

nameif

Name interfaces and assign security level. (Configuration mode.)

nameif hardware_id if_name security_level
show nameif

Syntax Description


hardware_id	The hardware name for the network interface that specifies the interface's slot location on the PIX Firewall motherboard. Interface boards are numbered from the leftmost slot nearest the power supply as slot 0. The internal network interface must be in slot 1. The lowest security_level external interface board is in slot 0 and the next lowest security_level external interface board is in slot 2. Possible choices are ethernetn for Ethernet or token-ringn for Token Ring. The internal interface is ethernet1. These names can be abbreviated with any leading characters in the name; for example, ether1, e2, token0, or t0.
if_name	A name for the internal or external network interface of up to 255 characters in length. This name can be uppercase or lowercase.
security_level	Either 0 for the outside network or 100 for the inside network. Perimeter interfaces can use any number between 1 and 99. For access from a higher security to a lower security level, nat and global commands or static commands must be present. For access from a lower security level to a higher security level, static and conduit commands must be present. Do not assign interfaces to the same security level.

Usage Guidelines

The nameif command lets you assign a name to an interface. You can use this command to assign interface names if you have more than two network interface circuit boards in your PIX Firewall.

The first two interfaces have the default names inside and outside. The inside interface has default security level 100, the outside interface has default security level 0.

Usage Notes

1. After changing a nameif command, save your configuration with the write memory command and then reboot the PIX Firewall.

2. The inside interface cannot be renamed or given a different security level.

3. An interface is always "outside" with respect to another interface that has a higher security level.

4. Refer to the current PIX Firewall release notes for information about the number of supported interfaces.

Example

nameif ethernet2 perimeter1 sec50
nameif ethernet3 perimeter2 sec20

nat

Associate a network with a pool of global IP addresses. (Configuration mode.)

nat [(if_name)] nat_id local_ip [netmask [max_conns [em_limit]]] [norandomseq]
no nat [[(if_name)] nat_id local_ip [netmask [max_conns [em_limit]]]] [norandomseq]
show nat

Syntax Description


if_name	The internal network interface name.
nat_id	Specify 0 to indicate that no address translation be used with local_ip. All nat statements with the same nat_id are in the same nat group. Use the nat_id in the global statement; for example: nat (perimeter) 1 0 0 global (outside) 1 204.31.17.1-204.31.17.254 This example associates the nat command with the global command via the nat_id. The nat_id is an arbitrary positive number between 0 and two billion. This number can be the same as the ID used with the outbound and apply commands.
local_ip	Internal network IP address to be translated. You can use 0.0.0.0 to allow all hosts to start outbound connections. The 0.0.0.0 local_ip can be abbreviated as 0.
netmask	Network mask for local_ip. You can use 0.0.0.0 to allow all outbound connections to translate with IP addresses from the global pool.
max_conns	The maximum connections permitted across all interfaces. Set this value to less than or equal to your connection license. Use show conn to view the maximum number of connections for your firewall. To accurately gauge the total number of connections you will permit to be used, add the max_conns value from the nat and static statements in your configuration. The total number must be less than or equal to your connection license.
em_limit	The embryonic connection limit. The default is 0, which means unlimited connections. The maximum depends on your connection license and the minimum is 1. A rule of thumb for the limit is the maximum number of connections on your connection license minus 30%; for example, on a 1024-session license, set it to at least 715. Set it lower for slower systems, higher for faster systems.
norandomseq	Do not randomize the TCP packet's sequence number. Only use this option if another inline firewall is also randomizing sequence numbers and the result is scrambling the data. Use of this option opens a security hole in the PIX Firewall.

Usage Guidelines

The nat command lets you enable or disable address translation for one or more internal addresses. Address translation means that when a host starts an outbound connection, the IP addresses in the internal network are translated into global addresses. Network Address Translation (NAT) lets your network have any IP addressing scheme and the firewall protects these addresses from visibility on the external network.

After changing or removing a nat statement, use the clear xlate command. If the previous condition persists, save your configuration with the write memory command and then reboot the PIX Firewall.

The connection limit lets you set the maximum number of outbound connections that can be started with the IP address criteria you specify. The embryonic connection limit lets you prevent a type of attack where processes are started without being completed. An embryonic connection is a connection that someone attempted but has not completed and has not yet seen data. Every connection is embryonic until it sets up.

You can use the no nat command to remove a nat statement and you can use the show nat command to view nat statements in the current configuration.

Table 5-2 helps you decide when to use the nat or static commands for access between the various interfaces in the PIX Firewall. For this table, assume that the security levels are 40 for dmz1 and 60 for dmz2.

Table 5-2: Interface Access Commands by Interface
From This Interface To This Interface Use This Command From This Interface To This Interface Use This Command

inside

outside

nat

dmz2

outside

nat

inside

dmz1

nat

dmz2

dmz1

nat

inside

dmz2

nat

dmz2

inside

static

dmz1

outside

nat

outside

dmz1

static

dmz1

dmz2

static

outside

dmz2

static

dmz1

inside

static

outside

inside

static

The rule of thumb is that for access from a higher security level interface to a lower security level interface, use the nat command. From lower security level interface to a higher security level interface, use the static command.

Usage Notes

1. You can disable address translation with the nat 0 command. Use this when you have IP addresses that are the same as those used on more than one interface. Adaptive Security remains in effect with the nat 0 command. The extent to which the inside hosts are accessible from the outside depends on the conduit statements that permit inbound access.

Addresses on each interface must be on a different subnet. Refer to Appendix E, "Subnet Masking and Addressing" for more information on subnetting.

The nat 0 1.2.3.0 command means let those IP addresses in the 1.2.3.0 net appear on the outside without translation. All other hosts are translated depending on how their nat statements appear in the configuration.

2. The nat 1 0 0 command means that all outbound connections can pass through the PIX Firewall with address translation. If you use the nat (inside) 1 0 0 command, users can start connections on any interface with a lower security level, on the both perimeter interfaces and the outside interface. With NAT in effect, you must also use the global statement to provide a pool of addresses through which translated connections pass. In effect, you use the nat statement to specify from which interface connections can originate and you use the global statement to determine at which interface connections can occur. The NAT ID must be the same on the nat and global statements.

3. The nat 1 1.2.3.0 command means that only outbound connections originating from the inside host 1.2.3.0 can pass through the firewall to go to their destinations with address translation.

See also: global, outbound, apply.

Examples

The following example specifies with nat statements that all the hosts on the 10.0.0.0 and 3.3.3.0 inside networks can start outbound connections. The global statements create a pool of global addresses.

nat (inside) 1 10.0.0.0 255.0.0.0
global (outside) 1 204.31.17.25-204.31.17.27
global (outside) 1 204.31.17.28
 
nat (inside) 3 3.3.3.0 255.255.255.0
global (outside) 3 204.31.18.1-204.31.18.254

When using the nat 0 command, if you want the addresses to be visible from the outside network, use the static and conduit command:

nat (inside) 0 204.31.17.0 255.255.255.0
static (inside, outside) 207.31.17.1 207.31.17.1
conduit permit tcp host 207.31.17.1 eq ftp host 10.0.0.1
static (inside, outside) 207.31.17.2 207.31.17.2
conduit permit tcp host 207.31.17.2 eq ftp host 10.0.0.1
...

outbound/apply

Create an access list for controlling Internet use. (Configuration mode.)

outbound list_ID permit|deny ip_address [netmask [java|port[-port]]] [protocol]
outbound list_ID except ip_address [netmask [java|port[-port]]] [protocol]
clear outbound
no outbound [list_ID permit|deny ip_address [netmask [java|port[-port]]] [protocol]]
no outbound [list_ID except ip_address [netmask [java|port[-port]]] [protocol]]
show outbound

apply [(if_name)] list_ID outgoing_src|outgoing_dest
clear apply
no apply [[(if_name)] list_ID outgoing_src|outgoing_dest]
show apply [(if_name)] [list_ID outgoing_src|outgoing_dest]

Syntax Description


list_ID	A tag number for the access list. The access list number you use must be the same for the apply and outbound commands. This value must be a positive number. This number can be the same as what you use with nat and global. This number is just an arbitrary number that groups outbound statements to an apply statement.
permit	Allow the access list to access the specified IP address and port.
deny	Deny the access list access to the specified IP address and port.
except	Create an exception to a previous outbound command. An except statement applies to permit or deny statements only with the same access list ID. When used with apply outgoing_src, the IP address of an except statement applies to the destination address. When used with apply outgoing_dest, the IP address of an except statement applies to the source address. Refer to "Outbound List Rules" for more information.
ip_address	The IP address for this access list entry. Do not specify a range of addresses. The 0.0.0.0 ip_address can be abbreviated as 0.
netmask	The network mask for comparing with the IP address; 255.255.255.0 causes the access list to apply to an entire Class C address. 0.0.0.0 indicates all access. The 0.0.0.0 netmask can be abbreviated as 0.
port	A port or range of ports that the access list is permitted or denied access to. Refer to the "Ports" section in Chapter 1, "Introduction" for a list of valid port literal names.
java	The java keyword indicates port 80 and when used with the deny option, means that the firewall blocks Java applets from being downloaded from ip_address (depending on use of the apply command). Java applets are permitted by default and do not have to be explicitly permitted.
protocol	Limit outbound access to udp, tcp, or icmp protocols. If a protocol is not specified, the default is tcp.
if_name	The network interface originating the connection.
outgoing_src	Deny or permit an internal IP address the ability to start outbound connections using the service(s) specified in the outbound command.
outgoing_dest	Deny or permit access to an external IP address using the service(s) specified in the outbound command.

Usage Guidelines

The outbound command creates an access list that lets you specify the following:

Whether inside users can create outbound connections
Whether inside users can access specific outside servers
What services inside users can use for outbound connections and for accessing outside servers
Whether outbound connections can execute Java applets on the inside network

Outbound lists are filters on outgoing packets from the PIX Firewall. The filter can be based on the source IP address, the destination IP address, and the destination port/protocol as specified by the rules. The use of an outbound command requires use of the apply command. The apply command lets you specify whether the access control list applies to inside users' ability to start outbound connections with apply command's outgoing_src option, or whether the access list applies to inside users' ability to access servers on the outside network with the apply command's outgoing_dest option.

After adding, removing, or changing outbound statements, save your configuration with the write memory command and then reboot the PIX Firewall.

Use the no outbound command to remove a single outbound statement from the configuration. Use the clear outbound command to remove all outbound statements from the configuration. The show outbound command displays the outbound statements in the configuration.

Use the no apply command to remove a single apply statement from the configuration. Use the clear apply statement to remove all the apply statements from the configuration. The show apply command displays the apply statements in the configuration.

Outbound List Rules

Rules, written as outbound list_ID ... statements are global to the PIX Firewall, they are activated by apply list_ID outgoing_src|outgoing_dest statements. When applied to outgoing_src, the source IP address, the destination port, and protocol are filtered. When applied to outgoing_dest, the destination IP address, port, and protocol are filtered.

The outgoing_src and outgoing_dest outbound lists are filtered independently. If any one of the filters contain deny, the outbound packet is denied. When multiple rules are used to filter the same packet, the best matched rule takes effect. The best match is based on the IP address mask and the port range check. More strict IP address masks and smaller port ranges are considered a better match. If there is a tie, a permit overrides a deny.

Rules are grouped by a list_ID. Within each list_ID, except rules (that is, outbound n except ...) can be set. The except option reverses the best matched rule of deny or permit. In addition, PIX Firewall filters the specified IP address and mask in the rule for the destination IP address of the outbound packet if the list is applied to the outbound_src. Alternatively, PIX Firewall filters the source IP address if the list is applied to the outgoing_dest. Furthermore, the except rules only apply to rules with the same list_ID. A single except rule within a list_ID without another permit or deny rule has no effect. If multiple except rules are set, the best match is checked for which except to apply.

In version 4.2, outbound rules are now sorted by the best match checking. Use the show outbound command to see how the best match is judged by the PIX Firewall.

Usage Notes

1. If outbound commands are not specified, the default behavior is to permit all outbound traffic and services from inside hosts.

2. After adding, changing, or removing an outbound and apply statement group, use the clear xlate command to make the IP addresses available in the translation table.

3. The outbound commands are processed linearly within a list_ID. In addition, list_IDs are processed sequentially in descending order. For example, the first statement you specify in an outbound list is processed first, then the next outbound statement in that list, and so on. Similarly, list_ID 10 is processed before list_ID 20, and so on.

4. When using outbound commands, it is often helpful to deny or permit access to the many before you deny or permit access to the specific. Start with an interface-wide specification such as the following that denies all hosts from starting connections:

outbound 1 deny 0 0 0
apply (inside) 1 outgoing_src

Then add statements that permit or deny hosts access to specific ports, for example:

outbound 1 deny 0 0 0

outbound 1 permit 10.1.1.1 255.255.255.255 23 tcp

outbound 1 permit 10.1.1.1 255.255.255.255 80 tcp

apply (inside) 1 outgoing_src

If you used the except option, you could state this same example as follows:

outbound 1 deny 0 0 0

outbound 1 except 204.31.17.11 255.255.255.255 23 tcp

outbound 1 except 204.31.17.11 255.255.255.255 80 tcp

apply (inside) 1 outgoing_src

In the above except statement, IP address 204. 31.17.11 is the destination IP address, not the source address. This means that everyone is denied outbound access, except those users going to 204.31.17.11 via Telnet or HTTP (80).

5. The Java applet blocking feature removes applets that come into the HTTP port. The
PIX Firewall removes applets containing a Java signature anywhere in the packet, but does not remove applets encapsulated in some archive files. Legitimate, non-Java files with Java signatures are also blocked.

6. If you permit access to port 80 (http), this also permits Java applets to be downloaded.
You must have a specific deny statement to block Java applets.

7. The maximum number of outbound list entries in a configuration is 2000.

8. Outbound lists have no effect on conduits which operate on inbound connections.

Examples

The first outbound group sets inside hosts so that they can only see and Telnet to perimeter hosts, and do DNS lookups. In this example, the perimeter network address is 204.0.0.0 and the network mask is 255.255.255.0:

outbound 9 deny 0.0.0.0 0.0.0.0 0 0
outbound 9 except 204.0.0.0 255.255.255.0 23 tcp
outbound 9 except 0.0.0.0 0.0.0.0 53 udp

The next outbound group in this same example lets hosts 10.1.1.11 and 10.1.1.12 go anywhere:

outbound 11 deny 0.0.0.0 0.0.0.0 0 0
outbound 11 permit 10.1.1.11 255.255.255.255 0 0
outbound 11 permit 10.1.1.12 255.255.255.255 0 0
outbound 11 permit 0.0.0.0 0.0.0.0 21 tcp
outbound 11 permit 10.3.3.3 255.255.255.255 143 tcp

This last outbound group in this same example lets hosts on the perimeter only access TCP ports 389 and 30303 and UDP port 53 (DNS). Finally, the apply statements set the outbound groups so that the permit and deny rules affect access to all external addresses.

outbound 13 deny 0.0.0.0 0.0.0.0 0 0                                                                                                  
outbound 13 permit 0.0.0.0 0.0.0.0 389 tcp
outbound 13 permit 0.0.0.0 0.0.0.0 30303 tcp
outbound 13 permit 0.0.0.0 0.0.0.0 53 udp
 
apply (inside) 9 outgoing_src
apply (inside) 11 outgoing_src
apply (perim) 13 outgoing_src

Controlling Outbound Connections

The following example prevents all inside hosts from starting outbound connections:

outbound 1 deny 0 0 0
apply (inside) 1 outgoing_src

The 0 0 0 at the end of the command means all IP addresses (0 is the same as 0.0.0.0), with a 0.0.0.0 subnet mask and for all services (port value is zero).

Conversely, the following example permits all inside hosts to start connections to the outside (this is the default if an access list is not created):

outbound 1 permit 0 0 0
apply (inside) 1 outgoing_src

Controlling Inside Hosts' Access to Outbound Services

The following example prevents inside host 192.168.1.49 from accessing the World Wide Web
(port 80):

outbound 11 deny 192.168.1.49 255.255.255.255 80 tcp
apply (inside) 11 outgoing_src

Controlling Inside Hosts' Access to Outside Servers

If your employees are spending too much time examining GIF images on a particular site with two web servers, you can use the following example to restrict this access:

outbound 12 deny 192.168.146.201 255.255.255.255 80 tcp
outbound 12 deny 192.168.146.202 255.255.255.255 80 tcp
apply (inside) 12 outgoing_dest

Preventing Use of Java Applets

The following example prevents all inside users from executing Java applets on the inside network:

outbound 1 deny 0 0 java
apply (inside) 1 outgoing_src

Using except Statements

An except statement only provides exception to items with the same list_ID. Consider the following example:

outbound 9 deny 0.0.0.0 0.0.0.0 0 0
outbound 9 except 20.0.0.0 255.0.0.0 23 tcp
outbound 9 except 0.0.0.0 0.0.0.0 53 udp
outbound 11 deny 0.0.0.0 0.0.0.0 0 0
outbound 11 permit 10.1.1.11 255.255.255.255 0 0
outbound 11 permit 10.1.1.12 255.255.255.255 0 0
outbound 11 permit 0.0.0.0 0.0.0.0 21 tcp
outbound 11 permit 10.3.3.3 255.255.255.255 143 tcp
outbound 13 deny 0.0.0.0 0.0.0.0 0 0
outbound 13 permit 0.0.0.0 0.0.0.0 389 tcp
outbound 13 permit 0.0.0.0 0.0.0.0 30303 tcp
outbound 13 permit 0.0.0.0 0.0.0.0 53 udp

In the preceding examples, the following two statement work against other statements in list 9 but not in lists 11 and 13.

outbound 9 except 20.0.0.0 255.0.0.0 23 tcp
outbound 9 except 0.0.0.0 0.0.0.0 53 udp

In the following example, the set of deny, permit, and except option statements denies everybody from connecting to external hosts except for DNS queries and Telnet connections to hosts on 20.0.0.0. The host with IP address 10.1.1.11 is permitted outbound access, and has access to everywhere except to 20.0.0.0 via Telnet and anywhere to use DNS:

outbound   1 deny 0.0.0.0 0.0.0.0 0 tcp
outbound   1 permit 10.1.1.11 255.255.255.255 0 tcp
outbound   1 except 20.0.0.0 255.0.0.0 23 tcp
outbound   1 except 0.0.0.0 0.0.0.0 53 udp
apply (inside) outgoing_src

pager

Enable or disable screen paging. (Privileged mode.)

pager [lines lines]
no pager
show pager

Syntax Definition


lines	The number of lines before the More prompt appears. The minimum is 1. Use 0 to disable paging.

Usage Guidelines

The pager lines command lets you specify the number of lines in a page before the More prompt appears. The pager command enables display paging, and no pager disables paging and lets output display completely without interruption. If you set pager lines to some value and want to revert back to the default, enter the pager command without options.

Use pager 0 to disable paging.

The show pager command displays pager status.

When paging is enabled, the following prompt appears:

<--- More --->

The More prompt uses syntax similar to the UNIX more command:

To view another screenful, press the Space bar.
To view the next line, press the Enter key.

To return to the command line, press the q key.

Example

pixfirewall# pager lines 2
pixfirewall# ping inside 10.0.0.42
        10.0.0.42 NO response received -- 1010ms
        10.0.0.42 NO response received -- 1000ms
<--- More --->

passwd

Set password for Telnet and PIX Firewall Manager access to the firewall console. (Privileged mode.)

passwd password [encrypted]
show passwd

Syntax Description


password	A case-sensitive password of up to 16 alphanumeric and special characters. Any character can be used except the question mark, space, and colon.
encrypted	Specifies that the password you entered is already encrypted. The password must be 16 characters in length.

Usage Guidelines

The passwd command sets a password for Telnet and PIX Firewall Manager access to the firewall console. An empty password is also changed into an encrypted string. However, any use of a write command displays or writes the passwords in encrypted form. Once passwords are encrypted, they are not reversible back to plain text.

Note Write down the new password and store it in a manner consistent with your site's security policy. Once you change this password, you cannot view it again.

Example

passwd watag00s1am
show passwd
passwd jMorNbK0514fadBh encrypted

perfmon

View performance information. (Configuration mode.)

perfmon interval seconds
perfmon quiet|verbose
show perfmon

Syntax Description


interval seconds	Specify the number of seconds between when the performance displays appear on the console. The default is 120 seconds.
quiet	Disable performance monitor displays.
verbose	Enable displaying performance monitor information at the PIX Firewall console.

Usage Guidelines

The perfmon command lets you monitor the PIX Firewall's performance. Use the show perfmon command to view the information immediately. Use the perfmon verbose command to display the information every two minutes continuously. Use the perfmon interval seconds command with the perfmon verbose command to display the information continuously every number of seconds you specify.

Use the perfmon quiet command to disable the display.

An example of the performance information is:

PERFMON STATS:

Current

Average

Xlates

33/s

20/s

Connections

110/s

10/s

TCP Conns

50/s

42/s

WebSns Req

4/s

2/s

TCP Fixup

20/s

15/s

HTTP Fixup

5/s

5/s

FTP Fixup

7/s

4/s

AAA Authen

10/s

5/s

AAA Author

9/s

5/s

AAA Account

3/s

3/s

This information lists the number of translations, connections, WebSENSE requests, address translations (called "fixups"), and AAA transactions that occur each second.

Example

The following commands display the performance monitor statistics every 30 seconds on the PIX Firewall console:

perfmon interval 30
perfmon verbose

ping

Determine if other IP addresses are visible from the PIX Firewall. (Privileged mode.)

ping if_name ip_address

Syntax Description


if_name	The internal or external network interface name. The address of the specified interface is used as the source address of the ping.
ip_address	The IP address of a host on the inside or outside networks.

Usage Guidelines

The ping command determines if the PIX Firewall has connectivity or if a host is available on the network. The command output shows if the response was received; that is, that the host exists on the network. If the host is not responding, ping displays "NO response received." Use show interface to ensure that the PIX Firewall is connected to the network and is passing traffic.

If you want internal hosts to be able to ping external hosts, you must create an ICMP conduit for echo reply; for example, to give ping access to all hosts, use the conduit permit icmp any any command.

If you are pinging through PIX Firewall between hosts or routers, but the pings are not successful, use the debug icmp trace command to monitor the success of the ping. If pings are both inbound and outbound, they are successful.

Example

The ping command makes three attempts to reach an IP address:

ping inside 192.168.42.54
192.168.42.54 response received -- 0Ms
192.168.42.54 response received -- 0Ms
192.168.42.54 response received -- 0Ms

quit

Exit configuration or privileged mode. (All modes.)

quit

Usage Guidelines

Use the quit command to exit configuration or privileged mode.

Example

pixfirewall(config)# quit
pixfirewall# quit
pixfirewall>

radius-server

Specify a RADIUS server for use with the aaa command. (Configuration mode.)

radius-server [(if_name)] host ip_address key [timeout seconds]
clear radius-server
no radius-server [(if_name)] host [[ip_address] [key]]
show radius-server

Syntax Description


if_name	The network interface where the authentication server resides. If not specified, the default is inside.
host ip_address	The IP address of a RADIUS authentication server.
key	A case-sensitive alphanumeric keyword of up to 127 characters defined by what the authentication server accepts. Any characters entered past 127 are ignored. The key is used between the client and server for encrypting data between them. The key must be the same on both the client and server systems. Spaces are not permitted in the key, but other special characters are.
timeout seconds	The maximum idle time permitted before PIX Firewall switches to the next RADIUS server you specified. The default is 5 seconds. The maximum time is 30 seconds.

Usage Guidelines

Specify a RADIUS server. Use show radius-server to view the information. Up to 16 TACACS+ and RADIUS servers are permitted. Servers are used in the order entered in the configuration. If the server is off-line or fails, the next server is checked. This continues until a working server is found. Use no radius-server to disable access to a host.

Use the radius-server command before you use the aaa command. The aaa command enables authentication, and accounting services for access to the RADIUS server you designate.

Note PIX Firewall does not support RADIUS authorization services.

The clear radius-server command removes all radius-server entries from the configuration.

Before using the clear radius-server command, remove the aaa commands that enable RADIUS authentication or accounting.

Example

radius-server (perimeter) host 192.168.42.42 whatakey!@#$%^&*
show radius-server
radius-server (perimeter) host 192.168.42.42 whatakey!@#$%^&*
aaa authentication any outside 192.168.42.42 255.255.255.255 0 0 radius

reload

Reboot and reload the configuration. (Privileged mode.)

reload

Usage Guidelines

The reload command reboots the PIX Firewall and reloads the configuration from a bootable floppy
disk or, if a diskette is not present, from Flash memory.

Note You are prompted for confirmation before starting with "Proceed with reload?".
Any response other than n causes the reboot to occur.

Note Configuration changes not written to Flash memory are lost after reload. Before rebooting, store the current configuration in Flash memory with the write memory command.

Example

reload
Proceed with reload?[confirm] y
 
Rebooting...
 
PIX Bios V2.7
...

rip

Change RIP settings. (Configuration mode.)

rip if_name default|passive
no rip [if_name default|passive]
show rip if_name

Syntax Description


if_name	The internal or external network interface name.
default	Broadcast a default route on the interface.
passive	Enable passive RIP on the interface. The PIX Firewall listens for RIP routing broadcasts and uses that information to populate its routing tables.

Usage Guidelines

The rip passive command enables IP routing table updates from received RIP (Routing Information Protocol) broadcasts. Use show rip to display the current RIP settings. Use no rip to disable the PIX Firewall IP routing table updates. The default is to enable IP routing table updates.

Example

show rip
rip outside passive
no rip outside default
rip inside passive
no rip inside default
rip inside default 
show rip
rip outside passive
no rip outside default
rip inside passive
rip inside default

route

Enter a static or default route for the specified interface. (Configuration mode.)

route if_name ip_address netmask gateway_ip [metric]
clear route [if_name ip_address [netmask gateway_ip]]
no route [if_name ip_address [netmask gateway_ip]]
show route

Syntax Description


if_name	The internal or external network interface name.
ip_address	The internal or external network IP address. Use 0.0.0.0 to specify a default route. The 0.0.0.0 IP address can be abbreviated as 0.
netmask	Specify a network mask to apply to ip_address. Use 0.0.0.0 to specify a default route. The 0.0.0.0 netmask can be abbreviated as 0.
gateway_ip	Specify the IP address of the gateway router (the next hop address for this route).
metric	Specify the number of hops to gateway_ip. If you are not sure, enter 1. Your network administrator can supply this information or you can use a traceroute command to obtain the number of hops. The default is 1 if a metric is not specified.

Usage Guidelines

Use the route command to enter a default or static route for an interface. To enter a default route, set ip_address and netmask to 0.0.0.0, or the shortened form of 0. All routes entered using the route command are stored in the configuration when it is saved.

Create static routes to access networks connected outside a router on any interface. The effect of a static route is like stating "to send a packet to the specified network, give it to this router." For example, PIX Firewall sends all packets destined to the 192.168.42.0 network through the 192.168.1.5 router with this static route statement:

route dmz 192.168.42.0 255.255.255.0 192.168.1.5 1

Note If the linkpath 0 0 command is used, the outside interface's default route statement is overridden and all outbound traffic is routed through Private Link to a central PIX Firewall unit.

Examples

Specify one default route statement for the outside interface, which in this example, has an IP address of 192.150.50.1:

route outside 0 0 192.150.50.1 1

For static routes, if two networks, 10.1.2.0 and 10.1.3.0 connect via a hub to the dmz1 interface router at 10.1.1.4, add these static route statements to provide access to the networks:

route dmz1 10.1.2.0 255.0.0.0 10.1.1.4 1
route dmz1 10.1.3.0 255.0.0.0 10.1.1.4 1

service

Reset inbound connections. (Configuration mode.)

service resetinbound
show service

Syntax Description


resetinbound	Reset inbound connections.

Usage Guidelines

The service command works with all inbound TCP connections to statics whose conduits or uauth (user authorization) do not allow inbound. One use is for resetting IDENT connections. If an inbound TCP connection is attempted and denied, you can use the service resetinbound command to return an RST (reset flag in the TCP header) to the source. Without the option, the PIX Firewall drops the packet without returning an RST.

For use with IDENT, the PIX Firewall sends a TCP RST to the host connecting inbound and stops the incoming IDENT process so that email outbound can be transmitted without having to wait for IDENT to time out. In this case, the PIX Firewall sends a syslog message stating that the incoming connection was a denied connection. Without service resetinbound, the PIX Firewall drops packets that are denied and generates a syslog message stating that the SYN was a denied connection. However, outside hosts keep retransmitting the SYN until the IDENT times out.

When an IDENT connection is timing out, you will notice that connections slow down. Perform a trace to determine that IDENT is causing the delay and then invoke the service command.

The service resetinbound command provides a safer way to handle an IDENT connection through the PIX Firewall. Ranked in order of security from most secure to less secure are these methods for handling IDENT connections:

1. Use the service resetinbound command.

2. Use the established command with the permitto tcp 113 options.

3. Create a static and conduit to open TCP port 113.

When using the aaa command, if the first attempt at authorization fails and a second attempt causes a timeout, use the service resetinbound command to reset the client that failed the authorization so that it will not retransmit any connections. An example authorization timeout message in Telnet is:

Unable to connect to remote host: Connection timed out

Example

service resetinbound
show service
service resetinbound

session

Access an embedded AccessPro router console. (Privileged mode.)

session enable
no session
show session

Note Only use this command if you have an AccessPro router installed in your PIX Firewall.

Syntax Description


enable	Enable the session command for communications with the AccessPro router.

Usage Guidelines

The session command lets you specify Cisco IOS commands on an AccessPro router console when the router is installed in your PIX Firewall. Use COM port 4 on the AccessPro router to communicate with the PIX Firewall.

Exit the router console session by entering tilde-dot (~.). Press the tilde key and when you hear a bell sound from your terminal, press the dot key.

While a router console session is occurring, the PIX Firewall disables failover because they both require the same interrupts.

Example

This example enables an AccessPro session, starts the session, and then disables it.

session enable
Session has been enabled.
session
 
Warning: FAILOVER has been disabled!!!
Attempting session with embedded router, use ~. to quit!
 
acpro> ~.
 
no session
Session has been disabled
session
Session is not enabled

show

View command information. (Differs by mode.)

show ?

Usage Guidelines

This command without arguments or the show ? command lets you view the names of the show commands and their descriptions. Explanations for each show command are provided on the respective command page for the command itself where appropriate; for example, show arp is described on the arp command page.

Note The show commands that do not have a command equivalent shown in this section are described on their respective command pages; for example, the show interface command is described on the interface command page.

If the pager command is enabled and when 24 lines display, the listing pauses, and the following prompt appears:

<--- More --->

The More prompt uses syntax similar to the UNIX more command:

To view another screenful, press the Space bar.
To view the next line, press the Enter key.
To return to the command line, press the q key.

Example

show ?
?               help ...

show blocks

Show system buffer utilization. (Privileged mode.)

show blocks

Usage Guidelines

This command lists system buffer utilization.

Example

pixfirewall(config)# show blocks
SIZE    MAX    LOW    CNT FAILED
     4   1600   1600   1600
    80    100     97     97
   256     80     79     79
1550    788    402    404
 65536      8      8      8

show checksum

Display the configuration checksum. (Unprivileged mode.)

show checksum

Usage Guidelines

This command displays four groups of hexadecimal numbers that act as a digital summary of the contents of the configuration. This same information stores with the configuration when you store it in Flash memory. By using the show config command and viewing the checksum at the end of the configuration listing and using the show checksum command, you can compare the numbers to see if the configuration has changed. The PIX Firewall tests the checksum to determine if a configuration has not been corrupted.

Example

show checksum
Cryptochecksum: 1a2833c0 129ac70b 1a88df85 650dbb81

show conn

Display the number of licensed connections and all active connections. (Privileged mode.)

show conn [count] [foreign|local ip[-ip2] [netmask mask]] [protocol tcp|udp|prot]
[fport|lport port1[-port2]] [state up[,finin][,finout][,http_get][,smtp_data][,smtp_banner]
[,smtp_incomplete][,nojava][,data_in][,data_out][,sqlnet_fixup_data]
[,conn_inbound][,rpc][,h323][,dump]

Syntax Description


count	Display only the number of licensed connections.
foreign\|local ip[-ip2] netmask mask	Display active connections by the foreign IP address or by local IP address. Qualify foreign or local active connections by network mask.
protocol tcp\|udp\|prot	Display active connections by protocol type. prot is a protocol specified by number. Refer to the "Protocols" section in Chapter 1, "Introduction" for a list of valid protocol literal names.
fport\|lport port1[-port2]	Display foreign or local active connections by port. Refer to the "Ports" section in Chapter 1, "Introduction" for a list of valid port literal names.
state	Display active connections by their current state: up (up), FIN inbound (finin), FIN outbound (finout), HTTP get (http_get), SMTP mail data (smtp_data), SMTP mail banner (smtp_banner), incomplete SMTP mail connection (smtp_incomplete), an outbound command denying access to Java applets (nojava), inbound data (data_in), outbound data (data_out), SQLNet data fix up (sqlnet_fixup_data), inbound connection (conn_inbound), RPC connection (rpc) , H.323 connection (h323), dump clean up connection (dump*).

Usage Guidelines

The function of the show conn command is new in version 4.2(3). Previous versions of this command only listed the number of connections. In version 4.2(3), the show conn command also lists all the active connections in the PIX Firewall. For version 4.2(2), use the show xlate command to list both the translation and connection information. Use the show conn count command to provide the same behavior as the version 4.2(2) show conn command; that is, to list only the number of connections that are used in the connection license. In version 4.2(3) only outbound connections from the inside or perimeter interfaces are counted against the connection license. (Outbound means a connection that moves from a higher security level interface to a lower security level interface, such as from the inside to the outside interfaces or from a perimeter interface to the outside interface.)

The show conn command displays the number and information about the active TCP connections. Refer to the section, "PIX Firewall Connection Licenses" in Chapter 1, "Introduction" for more information about how applications use TCP connections. Table 5-3 lists connection slot flags:

Table 5-3: Connection Slot Flags
Connection Flag Description

d

Dump, clean up connection.

f

FIN seen in inbound packet.

F

FIN seen in outbound packet.

H

HTTP get. If a UDP connection, H can also mean H.323.

I

Data in.

J

Java applets are not permitted on connection.

m

SMTP data.

O

Data out.

q

SQL*Net data fixup.

R

RPC

r

In use.

U

Connection is up.

Example

show conn
6 in use, 16378 remain, 6 most used
TCP out 204.31.17.41:80 in 10.3.3.4:1404 idle 0:00:00 Bytes 11391 flags UHrIO
TCP out 204.31.17.41:80 in 10.3.3.4:1405 idle 0:00:00 Bytes 3709 flags UHrIO
TCP out 204.31.17.41:80 in 10.3.3.4:1406 idle 0:00:01 Bytes 2685 flags UHrIO
TCP out 204.31.17.41:80 in 10.3.3.4:1407 idle 0:00:01 Bytes 2683 flags UHrIO
TCP out 204.31.17.41:80 in 10.3.3.4:1403 idle 0:00:00 Bytes 15199 flags UHrIO
TCP out 204.31.17.41:80 in 10.3.3.4:1408 idle 0:00:00 Bytes 2688 flags UHrIO
UDP out 192.150.50.70:24 in 10.3.3.4:1402 idle 0:01:30 flags d
UDP out 192.150.50.70:23 in 10.3.3.4:1397 idle 0:01:30 flags d
UDP out 192.150.50.70:22 in 10.3.3.4:1395 idle 0:01:30 flags d

show version
 
PIX Version 4.2(n)nnn Point
Compiled on Sat 16-May-98 04:08 by pixbuild
Finesse Bios V3.3
 
pixfirewall up 100 days 6 hours 17 mins
 
Hardware:   Pentium 133, 16 MB RAM, CPU Pentium 133 MHz
Flash atmel @ base 0x300
0: ethernet0: address is 00a0.c90a.eb4d
1: ethernet1: address is 00a0.c986.8eea
2: ethernet2: address is 00a0.c90a.eb43
Serial Number: 0600nnnn

snmp-server

Provide SNMP event information. (Configuration mode.)

snmp-server community key
snmp-server contact text
snmp-server host if_name local_ip
snmp-server location text
snmp-server enable traps
clear snmp-server [contact text]
clear snmp-server [host if_name local_ip]
clear snmp-server [location text]
no snmp-server [contact text]
no snmp-server [host if_name local_ip]
no snmp-server [location text]
no snmp-server enable traps
show snmp-server

Syntax Description


community	Indicate that you are entering the password key value in use at the SNMP server. SNMP community strings are a shared secret between the SNMP client and server. They are effectively a password used to determine if the SNMP request is valid.
key	A case-sensitive key value in use at the SNMP server. This string can be up to 32 characters in length. Spaces are not permitted. The default, if this option is not used, is public. Only use the key in effect at the server, do not make up a key value for the snmp-server command.
contact	Indicate that you are supplying your name or that of the PIX Firewall system administrator.
host	Indicate that you are specifying an IP address of a host to which SNMP traps should be sent. You can specify a maximum of 5 host IP addresses.
if_name	The interface name where the SNMP server resides.
local_ip	When used with the host option, the IP address of a host to which SNMP traps should be sent. You can specify a maximum of 5 host IP addresses.
location	Indicate that you are specifying your PIX Firewall location.
text	When used with the contact option, specify your name or that of the PIX Firewall system administrator. When used with location, specify your PIX Firewall location. The text is case-sensitive and can be up to 127 characters. Spaces are accepted, but multiple spaces are shortened to a single space.
enable traps	Enable or disable sending SNMP trap notifications via syslog.

Usage Guidelines

Use the snmp-server command to identify your name, location, and the host to which SNMP traps should be sent. Refer to "Step 15 - Enable Syslog" in Chapter 2, "Configuring the PIX Firewall" for more information on SNMP events. The clear snmp-server and no snmp-server commands remove the information. The show snmp-server command displays the information.

To send traps to an SNMP server:

Step 1 Identify the IP address of the SNMP server with the snmp-server host command.

Step 2 Set the snmp-server options for location, contact, and the community password as required.

Step 3 Set the logging level with the logging trap command; for example:

logging trap debugging

Cisco recommends that you use the debugging level during initial setup and during testing. Thereafter, set the level from debugging to errors for production use.

Step 4 Start sending syslog messages to the server with the logging on command.

Only syslog messages in the syslog MIB are controlled by this command.

Example

snmp-server community wallawallabingbang
snmp-server location Building 42, Sector 54
snmp-server contact Sherlock Holmes
snmp-server host perimeter 10.1.2.42
show snmp
snmp-server host 10.1.2.42
snmp-server location Building 42, Sector 54
snmp-server contact Sherlock Holmes
snmp-server community wallawallabingbang

static

Map local IP address to a global IP address. (Configuration mode.)

static [(internal_if_name, external_if_name)] global_ip local_ip [netmask network_mask]
[max_conns [em_limit]] [norandomseq]
no static [[(internal_if_name, external_if_name)] global_ip local_ip[netmask network_mask]
[max_conns [em_limit]] [norandomseq]]
show static

Syntax Description


internal_if_name	The internal network interface name. The higher security level interface you are accessing.
external_if_name	The external network interface name. The lower security level interface you are accessing.
global_ip	A global IP address. This address cannot be a PAT (Port Address Translation) IP address. The IP address on the lower security level interface you are accessing.
local_ip	The local IP address from the inside network. The IP address on the higher security level interface you are accessing.
netmask	Reserve word required before specifying the network mask.
network_mask	The network mask pertains to both global_ip and local_ip. Use a netmask of 255.255.255.255 for all ranges of IP addresses.
max_conns	The maximum number of connections permitted through the static at the same time.
em_limit	The embryonic connection limit. An embryonic connection is one that has started but not yet completed. Set this limit to prevent attack by a flood of embryonic connections. The default is 0, which means unlimited connections.
norandomseq	Do not randomize the TCP/IP packet's sequence number. Only use this option if another inline firewall is also randomizing sequence numbers and the result is scrambling the data. Use of this option opens a security hole in the PIX Firewall.

Usage Guidelines

The static command creates a permanent mapping (called a static translation slot or "xlate") between a local IP address and a global IP address. Use the static and conduit commands when you are accessing an interface of a higher security level from an interface of a lower security level; for example, when accessing the inside from a perimeter or the outside interface.

The interface names on the static command may seem confusing at first. This is further complicated by how NAT is handled on the PIX Firewall. If NAT is disabled, with the nat 0 command, statics are specified with a different set of rules than when NAT is enabled. For either no NAT or NAT, the rule of which command to access an interface stays the same as shown in Table 5-4.

Table 5-4 assumes that the security levels are 40 for dmz1 and 60 for dmz2.

Table 5-4: Interface Access Commands by Interface
From This Interface To This Interface Use This Command

inside

outside

nat

inside

dmz1

nat

inside

dmz2

nat

dmz1

outside

nat

dmz1

dmz2

static

dmz1

inside

static

dmz2

outside

nat

dmz2

dmz1

nat

dmz2

inside

static

outside

dmz1

static

outside

dmz2

static

outside

inside

static

With NAT Enabled

NAT (Network Address Translation) is enabled with the nat n command where "n" has the value 1 or greater; for example, nat 1 0 0.

Always specify the interface name of the highest security level interface you are accessing, followed by the lower security level interface. The IP addresses are also confusing because the first IP address you specify is for the lower security level interface. The second IP address is for the higher security level interface. The way to remember this is as follows:

static (high,low) low high

For example, assume you have four interfaces on the PIX Firewall that have security levels set with the nameif command as follows:

nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz1 security40
nameif ethernet3 dmz2 security60

To access the inside from the outside interface, you need a static command like:

static (inside,outside) outside_ip_address inside_ip_address netmask 255.255.255.255

Replace outside_ip_address with the global IP address (an IP address on the lower security level interface). Replace inside_ip_address with the IP address of the host on the higher security level interface that you want to grant access to. Use these replacements in the rest of the commands in this section.

To access the inside from the dmz1 interface, you need a static command like:

static (inside,dmz1) dmz1_ip_address inside_ip_address netmask 255.255.255.255

To access the inside from the dmz2 interface, you need a static command like:

static (inside,dmz2) dmz2_ip_address inside_ip_address netmask 255.255.255.255

To access the dmz2 interface from the dmz1 interface, you need a static command like:

static (dmz2,dmz1) dmz1_ip_address dmz2_ip_address netmask 255.255.255.255

To go the other way around, from a higher security level interface to a lower security level interface, use the nat and global commands. For example, to access dmz1 from dmz2, use these commands:

nat (dmz2) 1 0 0
global (dmz1) 1 global_ip_address-global_ip_address

Replace global_ip_address-global_ip_address with the IP address range of the addresses in the pool of global addresses. The nat command specifies the name of the higher security level interface; the pool of global addresses are on the lower security level interface.

View the nat command page for more information on using these commands.

Note If you use a static command, you must also use a conduit command. The static command makes the mapping, the conduit command lets users access the static mapping.

The first IP address you specify in the static command is the first IP address you specify in the conduit command as shown in this example:

static (dmz2,dmz1) 10.1.1.1 192.168.1.1 netmask 255.255.255.255
conduit permit tcp host 10.1.1.1 10.1.1.0 255.255.255.0

The static command maps the address 10.1.1.1 on the dmz1 interface so that users on the dmz1 interface can access the 192.168.1.1 host on the dmz2 interface. The conduit command lets any users in the 10.1.1.0 network access the 10.1.1.1 address over any TCP port.

Note Always make conduit statements as specific as possible. Using the any option to allow any host access should be used with caution for conduits used with statics.

With No-NAT

With no-NAT, the static command has a different sense of logic. With NAT disabled, addresses on both sides of the firewall are registered addresses. Between interfaces, addresses must be on different subnets that you control with subnetting. Refer to Appendix E, "Subnet Masking and Addressing" for more information.

Without address translation, you protect addresses on the inside or perimeter interfaces by not providing access to them. Without a conduit statement, the inside host cannot be accessed on the outside and is, in effect, invisible to the outside world. Conversely, only by opening statics and conduits to servers on the inside or perimeter interfaces, do the hosts become visible.

The format of the static command becomes different:

static (high,low) high high

Again, the security level set for each interface with the nameif command determines what information you fill in. You are using static to access a higher security interface from a lower security interface. The IP address you want visible on the lower security interface is that of the higher security interface. This is the IP address users on the lower security interface's network will use to access the server on the higher security level interface's network. Because address translation is not occurring, the actual address of the server is presented as both the visible address and the address of the host.

For example, a web server on the dmz, 204.31.17.65 needs to be accessible by users on the outside. The static and conduit statements are:

static (dmz,outside) 204.31.17.65 204.31.17.65 netmask 255.255.255.192
conduit permit tcp host 204.31.17.65 eq www any

The static command presents the 204.31.17.65 address on the outside interface. The DNS server on the outside would map this IP address to the domain of the company; for example, domain1.com. Users accessing domain1.com are permitted to access the web server via port 80 by the conduit command.

Another example of no-NAT statics would be when users on dmz1 need to access a web server on dmz2. The network uses a Class C address and subnets it with the .192 subnet. Addresses 204.31.17.65 to 204.31.17.126 are on dmz1, and addresses 204.31.17.129 to 204.31.17.190 are on dmz2. The web server is at 204.31.17.142. The static and conduit statements are:

static (dmz2,dmz1) 204.31.17.142 204.31.17.142 netmask 255.255.255.192
conduit permit tcp host 204.31.17.142 eq www 204.31.17.64 255.255.255.192

The static statement opens access to the web server at 204.31.17.142. The conduit statement permits access to the web server only on port 80 (www) and further refines the access to stipulate that only users on the 204.31.17.64 subnet can access the web server. Refer to Appendix E, "Subnet Masking and Addressing" for more information on subnetting.

Additional static Information

After changing or removing a static statement, use the clear xlate command. If the previous condition persists, save your configuration with the write memory command and then reboot the PIX Firewall.

You can create a single mapping between the global and local hosts, or create a range of statics known as net statics.

The static command determines the network mask of network statics by the netmask option or by the number in the first octet of the global IP address. The netmask option can be used to override the number in the first octet. If the address is all zeros where the net mask is zero, then the address is a net address.

Note Use a netmask of 255.255.255.255 when specifying a host.

Note Do not create statics with overlapping global IP addresses.

You can have as many statics as needed as long the total size of your configuration does not exceed 1,625,088 characters if your PIX Firewall has a 2 MB Flash memory board, or 102,400 characters if your PIX Firewall has a 512 KB Flash memory board. To determine what type of board is in your firewall, use the show version command. The 2 MB board contains this statement in the display:

Flash atmel @ base 0x300

See also: conduit.

Examples

The example that follows creates a static command and then permits users to call in through H.323 using Intel InternetPhone or MS NetMeeting to 10.1.1.222 using IP address 204.31.17.222 to 10.1.1.188 using IP address 204.31.17.188, and so on. The net static command that follows maps addresses 204.31.17.1 through 204.31.17.254 to local addresses 10.1.1.1 through 10.1.1.254.

static (inside, outside) 204.31.17.0 10.1.1.0 8 50
conduit permit tcp host 204.31.17.0 eq h323 any

The following example shows the commands used to disable Mail Guard:

static (dmz1,outside) 204.31.17.1 10.1.1.1 netmask 255.255.255.255
conduit permit tcp host 204.31.17.1 eq smtp any
no fixup protocol smtp 25

syslog

Enable syslog message facility. Obsolete command replaced by the logging command. (Privileged mode.)

Note Refer to the logging command for more information. The syslog command is available for backward compatibility.

sysopt

Change PIX Firewall system options. (Configuration mode.)

sysopt connection tcpmss bytes
no sysopt connection tcpmss bytes
sysopt connection timewait
no sysopt connection timewait
sysopt security fragguard
no sysopt security fragguard
clear sysopt
show sysopt

Syntax Description


connection tcpmss bytes	Force TCP proxy connection to have a maximum segment size no greater than bytes.
connection timewait	Force each TCP connection to linger in a shortened TIME_WAIT state of at least 15 seconds after the final normal TCP close-down sequence.
security fragguard	Enable the IP Frag Guard feature.

Usage Guidelines

The sysopt commands let you tune various PIX Firewall security and configuration features. In addition, you can use this command to disable the PIX Firewall IP Frag Guard feature.

sysopt connection tcpmss

The sysopt connection tcpmss command forces proxy TCP connections to have a maximum segment size no greater than bytes. This command requests that each side not send a packet of a size greater than bytes at any time during the initial TCP connection establishment.

Note If the client sending the proxy TCP connection does not announce a maximum segment size, PIX Firewall assumes that the RFC 793 default value of 536 bytes is in effect. If the client announces a maximum segment size larger than the number of bytes, PIX Firewall reduces the maximum segment size to bytes.

The bytes value can be a minimum of 28 and any maximum number. You can disable this feature by setting bytes to zero. The default is 1460 bytes, which Cisco recommends for Ethernet and mixed Ethernet and Token Ring environments. If the PIX Firewall has all Token Ring interfaces, you can set bytes to 4056. However, if even one link along the path through the network is not a Token Ring, setting bytes to such a high value may cause poor throughput. In its 1460 byte default value, this command increases throughput of the sysopt security fragguard command.

The TCP maximum segment size is the maximum size that an end host can inject into the network at one time (see RFC 793 for more information on the TCP protocol). The sysopt connection tcpmss command is recommended in a network environment being attacked by an overly aggressive TCP or HTTP stack with a faulty path MTU value that is degrading the performance of the PIX Firewall IP Frag Guard feature. Environments where one or more end hosts reside on a Token Ring network are especially susceptible to attack by aggressive TCP or HTTP stacks.

Note This command only works when the sysopt security fragguard command is enabled. Although, not advised for normal use of this feature, if you view the syslog IPFRAG messages 209001 and 209002, you can raise the bytes value.

sysopt connection timewait

The sysopt connection timewait command forces each TCP connection to linger in a shortened TIME_WAIT state of at least 15 seconds.

The connection timewait option is necessary for end host applications whose default TCP terminating sequence is simultaneous close instead of the normal shutdown sequence (see RFC 793). In simultaneous close, four TCP segments are exchanges in the shutdown instead of the normal three.

The default behavior of the PIX Firewall is to track the normal three shutdown sequence and release the connection after the third segment. This quick release heuristic enables the PIX Firewall to sustain high connection rate and save the end user in term of the license count.

However with simultaneous close, the quick release will force one side of the connection to linger in the CLOSING state (see RFC 793). Many sockets in the CLOSING state can degrade the performance of an end host. For instance, some WinSock mainframe clients are known to exhibit this behavior and degrade the performance of the mainframe server. Old versions of HP/UX are also susceptible to this behavior. Enabling the connection timewait option enables a "quiet time" window for the abnormal close down sequence to complete.

The no sysopt connection timewait command disables the option, which is off by default.

Note Use of the sysopt connection timewait command may impact PIX Firewall performance especially with low memory configuration and highly dynamic traffic pattern such as HTTP.

sysopt security fragguard

The sysopt security fragguard command enables the IP Frag Guard feature. This feature enforces two addition security checks in addition to the security checks recommend by RFC 1858 against the many IP fragment style attacks: teardrop, land, and so on. First, each non-initial IP fragments is required to be associated with an already seen valid initial IP fragments. Second, IP fragments are rated to 100 full IP fragmented packets per second to each internal host.

The IP Frag Guard feature operates on all interfaces in the PIX Firewall and cannot be selectively enabled or disabled by interface.

PIX Firewall uses the security fragguard command to enforce the security policy determined by a conduit permit or conduit deny command to permit or deny packets through the PIX Firewall.

Note Use of the sysopt security fragguard command breaks normal IP fragmentation conventions. However, not using this command exposes PIX Firewall to the possibility of IP fragmentation attacks. Cisco recommends that packet fragmentation not be permitted on the network if at all possible.

Note If PIX Firewall is used as a tunnel for FDDI packets between routers, disable the security fragguard feature.

Note Because Linux sends IP fragments in reverse order, fragmented Linux packets will not pass through the PIX Firewall with the sysopt security fragguard command enabled.

The show sysopt command lists the sysopt commands in the configuration. The clear sysopt command resets the sysopt command to default settings. The no sysopt security fragguard disables the IP Frag Guard feature.

Example

no sysopt security fragguard
show sysopt
sysopt security fragguard
no sysopt connection tcpmss
no sysopt connection timewait

tacacs-server

Specify a TACACS+ server for use with the aaa command. (Privileged mode.)

tacacs-server [(if_name)] host ip_address [key] [timeout seconds]
clear tacacs-server
no tacacs-server [(if_name)] host [[ip_address] [key]]
show tacacs-server

Syntax Description


if_name	The network interface where the authentication server resides. If not specified, the default is inside.
ip_address	The IP address of a TACACS+ authentication server. The IP address is used as the source address of the TACACS+ request, and the request is transmitted on the interface.
key	A case-sensitive alphanumeric keyword of up to 127 characters that is the same value as the key on the TACACS+ server. Any characters entered past 127 are ignored. The key is used between the client and server for encrypting data between them. The key must be the same on both the client and server systems. Spaces are not permitted in the key, but other special characters are.
timeout seconds	The maximum idle time permitted before PIX Firewall switches to the next TACACS+ server you specified. The default is 5 seconds. The maximum time is 30 seconds.

Usage Guidelines

Specify a TACACS+ server. Use show tacacs-server to examine the information. Up to 16 TACACS+ and RADIUS servers are permitted. Servers are used in the order entered in the configuration. If the server is offline or fails, the next server is checked. This continues until a working server is found. Use the tacacs-server command before you use the aaa command. The aaa command enables authentication, authorization, and accounting services for access to the TACACS+ server you designate.

The clear tacacs-server command removes all tacacs-server entries from the configuration.

Note Before using the clear tacacs-server command, remove the aaa commands that enable TACACS+ authentication, authorization, or accounting.

Note The key parameter is optional. If you do not specify a key, communications with the TACACS+ server are not encrypted.

Example

tacacs-server (perimeter) host 192.168.42.42 whatakey!@#$%^&*
show tacacs-server
tacacs-server (perimeter) host 192.168.42.42 whatakey!@#$%^&*
aaa authentication any outside 192.168.42.42 255.255.255.255 0 0 tacacs+

tcpchecksum

Test for a TCP checksum error. (Configuration mode.)

tcpchecksum [silent|verbose]
no tcpchecksum
show tcpchecksum

Syntax Description


silent	Disable TCP checksum error checking.
verbose	Display warning on PIX Firewall console if TCP checksum error occurs.

Usage Guidelines

Check for TCP segment integrity and report the error if found.

Example

tcpchecksum verbose
show tcpchecksum
tcpchecksum verbose

telnet

Allow an inside IP address access to the PIX Firewall console over Telnet. (Privileged mode.)

telnet local_ip [netmask]
clear telnet [local_ip [netmask]]
no telnet [local_ip [netmask]]
show telnet
telnet timeout minutes
show telnet timeout

Syntax Description


local_ip	The internal IP address or network of a host that is authorized to access the PIX Firewall Telnet console interface.
netmask	Bit mask of local_ip. To limit access to a single IP address, use 255 in each octet; for example, 255.255.255.255. If you do not specify netmask, it defaults to 255.255.255.255 regardless of the class of local_ip. This is not the subnetwork mask of the internal network. It is only a bit mask for the IP address in local_ip.
timeout minutes	The number of minutes that a Telnet session can be idle before being closed by PIX Firewall. The default is 5 minutes. Setting minutes to zero keeps the current value. Cisco recommend that you use values between 1 and 60.

Usage Guidelines

The telnet command lets you decide who can access the PIX Firewall with Telnet. Up to 16 hosts or networks are allowed access to the PIX Firewall console with Telnet, 5 simultaneously. The show telnet command displays the current list of IP addresses authorized to access the PIX Firewall. Use no telnet or clear telnet to remove Telnet access from a previously set IP address. Use the telnet timeout feature to set the maximum time a console Telnet session can be idle before being logged off by PIX Firewall. The clear telnet command does not affect the telnet timeout duration. The no telnet command cannot be used with the telnet timeout feature.

Use the passwd command to set a password for Telnet access to the console. The default is cisco. Use the who command to view which IP addresses are currently accessing the firewall console. Use the kill command to terminate an active Telnet console session.

If the aaa command is used with the console option, Telnet console access must be authenticated with an authentication server. Authentication of the serial console creates a potential dead-lock situation if the authentication server requests are not answered and you need access to the console to attempt diagnosis. If the console login request to authentication times out, you can gain access to the PIX Firewall from the serial console by entering the pix username and the password set with the enable password command.

Usage Notes

1. To access the PIX Firewall with Telnet, specify the IP address of the inside interface. For example, if the inside interface is 192.168.1.1, use the following command:

telnet 192.168.1.1

2. The default password to access the PIX Firewall console via Telnet is cisco.

3. Some Telnet applications such as the Windows 95 or Windows NT Telnet sessions may not support access to the PIX Firewall's command history feature via the arrow keys. However, you can access the last entered command by pressing Ctrl-P.

4. The telnet timeout command affects the next session started but not the current session.

5. If you connect a computer directly to the inside interface of the PIX Firewall with Ethernet to test Telnet access, you must use a cross-over cable and the computer must have an IP address on the same subnet as the inside interface. The computer must also have its default route set to be the inside interface of the PIX Firewall.

6. Telnet access to the console must be configured before you use PIX Firewall Manager.

7. With Telnet, you can configure the PIX Firewall only from the inside network or over Private Link.

8. If you need to access the PIX Firewall console from outside the PIX Firewall, you can use a static and conduit command pair to permit a Telnet session to a Telnet server on the inside interface, and then from the server to the PIX Firewall. In addition, you can attach the console port to a modem (using the same terminal settings as you would for HyperTerminal---described in the section "Step 2 - Get a Console Terminal" in Chapter 2, "Configuring the PIX Firewall"), but this may add a security problem of its own.

See also: aaa, kill, passwd, who.

Examples

The following examples permit hosts 192.168.1.3 and 192.168.1.4 to access the PIX Firewall console via Telnet. In addition, all the hosts on the 192.168.2.0 network are given access.

telnet 192.168.1.3 255.255.255.255 
telnet 192.168.1.4 255.255.255.255
telnet 192.168.2.0 255.255.255.0
show telnet
          192.168.1.3 255.255.255.255
          192.168.1.4 255.255.255.255
          192.168.2.0 255.255.255.0

You can remove individual entries with the no telnet command or all telnet statements with the clear telnet command:

no telnet 192.168.1.3
show telnet
          192.168.1.4 255.255.255.255
          192.168.2.0 255.255.255.0
clear telnet
show telnet

You can change the maximum session idle duration as follows:

telnet timeout 10
show telnet timeout
telnet timeout 10 minutes

An example Telnet console login session appears as follows (the password does not display when entered):

PIX passwd: cisco
 
Welcome to the PIX firewall
 
Copyright (c) 1995-1998 by Cisco Systems, Inc.
 
Restricted Rights Legend
 
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
 
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
 
Type help or `?' for a list of available commands.
pixfirewall>

terminal

Change console terminal state. (Configuration mode.)

terminal [no] monitor

Syntax Description


monitor	Enable or disable syslog message displays on the console.

Usage Guidelines

The terminal monitor command lets you enable or disable the display of syslog messages in the current session for either Telnet or serial access to the PIX Firewall console. Use the logging monitor command to enable or disable various levels of syslog messages to the console; use the terminal no monitor command to disable the messages on a per session basis. Use terminal monitor to restart the syslog messages for the current session.

Example

logging monitor
...
terminal no monitor

tftp-server

Specify the IP address of the TFTP configuration server. (Configuration mode.)

tftp-server local_ip path
no tftp-server [local_ip path]
show tftp-server

Syntax Description


local_ip	The internal IP address or network of the TFTP server.
path	The path and filename of the configuration file. The format for path differs by the type of operating system on the server. The contents of path are passed directly to the server without interpretation or checking. The configuration file must exist on the TFTP server. Many TFTP servers require the configuration file to be world-writable to write to it and world-readable to read from it.

Usage Guidelines

The tftp-server command lets you specify the IP address of a server that you use to propagate PIX Firewall configuration files to your firewalls. Use tftp-server with the configure net command to read from the configuration or with the write net command to store the configuration in the file you specify.

The contents of the path name you specify in tftp-server are appended to the end of the IP address you specify in the configure net and write net commands. The more of a file and path name specification you provide with the tftp-server command, the less you need to do with the configure net and write net commands. If you specify the full path and filename in tftp-server, the IP address in configure net and write net can be represented with a colon (:).

The no tftp server command disables access to the server. The show tftp-server command lists the tftp-server statements in the current configuration.

Example

The following example specifies a TFTP server and then reads the configuration from /pixfirewall/config/test_config:

tftp-server 10.1.1.42 /pixfirewall/config/test_config
...
configure net :

timeout

Set the maximum idle time duration. (Configuration mode.)

timeout [xlate [hh:mm:ss]] [conn [hh:mm:ss]] [udp [hh:mm:ss]] [rpc [hh:mm:ss]]
[h323 [hh:mm:ss]] [uauth [hh:mm:ss] [absolute|inactivity]]
show timeout

Syntax Description


xlate hh:mm:ss	Idle time until a translation slot is freed. This duration must be at least 5 minutes. The default is 3 hours.
conn hh:mm:ss	Idle time until a connection slot is freed. Use 0:0:0 for the time value to never time out a connection. This duration must be at least 5 minutes. The default is 1 hour.
udp hh:mm:ss	Idle time until a UDP slot is freed. This duration must be at least 1 minute. The default is 2 minutes.
rpc hh:mm:ss	Idle time until an RPC slot is freed. This duration must be at least 1 minute. The default is 10 minutes.
h323 hh:mm:ss	Duration for H.323 (InternetPhone) inactivity timer. When this time elapses, the port used by the H.323 service closes. This duration must be at least 5 minutes. The default is 5 minutes.
uauth hh:mm:ss	Duration before authentication and authorization cache times out and user has to reauthenticate next connection. This duration must be shorter than the xlate values. Set to 0 to disable caching. Do not set to zero if passive FTP is used on the connections.
absolute	Run uauth timer continuously, but after timer elapses, wait to reprompt the user until the user starts a new connection, such as clicking a link in a web browser. The default uauth timer is absolute. To disable absolute, set the uauth timer to 0 (zero).
inactivity	Start uauth timer after a connection becomes idle.

Usage Guidelines

The timeout command sets the idle time for connection, translation UDP, RPC, and H.323 slots. If the slot has not been used for the idle time specified, the resource is returned to the free pool. TCP connection slots are freed approximately 60 seconds after a normal connection close sequence.

Note Do not use timeout uauth 0:0:0 if passive FTP for the connection, or if the virtual command is used for Web authentication.

uauth inactivity and absolute Qualifiers

The uauth inactivity and absolute qualifiers cause users to have to reauthenticate after either a period of inactivity or an absolute duration.

Note If you set the inactivity timer to a duration, but the absolute timer to zero, then users are only reauthenticated after the inactivity timer elapses. If you set both timers to zero, then users have to reauthenticate on every new connection.

The inactivity timer starts after a connection becomes idle. If a user establishes a new connection before the duration of the inactivity timer, the user is not required to reauthenticate. If a user establishes a new connection after the inactivity timer expires, the user must reauthenticate. The default durations are zero for the inactivity timer and 5 minutes for the absolute timer; that is, the default behavior is to cause the user to reauthenticate every 5 minutes.

The absolute timer runs continuously, but waits to reprompt the user when the user starts a new connection, such as clicking a link and the absolute timer has elapsed, then the user is prompted to reauthenticate. The absolute timer must be shorter than the xlate timer; otherwise, a user could be reprompted after their session already ended.

Inactivity timers give users the best Web access because they are not prompted to regularly reauthenticate. Absolute timers provide security and manage the PIX Firewall connections better. By being prompted to reauthenticate regularly, users manage their use of the resources more efficiently. Also by being reprompted, you minimize the risk that someone will attempt to use another user's access after they leave their workstation, such as in a college computer lab. You may want to set an absolute timer during peak hours and an inactivity timer thereafter.

Both an inactivity timer and an absolute timer can operate at the same time, but you should set the absolute timer duration longer than the inactivity timer. If the absolute timer is less than the inactivity timer, the inactivity timer never occurs. For example, if you set the absolute timer to 10 minutes and the inactivity timer to an hour, the absolute timer reprompts the user every 10 minutes; therefore, the inactivity timer will never be started.

Use show timeout to display the current timeout settings.

Examples

show timeout
timeout xlate 3:00:00 conn 1:00:00 udp 0:02:00
timeout rpc 0:10:00 h323 0:05:00 
timeout uauth 0:05:00 absolute
 
timeout uauth 0:5:00 absolute uauth 0:4:00 inactivity
show timeout
timeout xlate 3:00:00 conn 1:00:00 udp 0:02:00
timeout rpc 0:10:00 h323 0:05:00 
timeout uauth 0:05:00 absolute uauth 0:04:00 inactivity

tunnel

Assign an IP address to a Ravlin IPSec encryption card. (Configuration mode.)

tunnel ip if_name ip_address [mask]
clear tunnel ip if_name ip_address [mask]
no tunnel ip if_name ip_address [mask]
show tunnel

Syntax Description


if_name	The network interface name for the Ravlin IPSec encryption card. Use the name you assigned with the nameif command.
ip_address	The IP address for the Ravlin IPSec encryption card and the PIX Firewall Encapsulating Security Payload (ESP) IP address.
mask	Network mask of ip_address.

Usage Guidelines

The tunnel ip command assigns an IP address to the Ravlin IPSec encryption card's network tunnel. This tunnel also functions as an SNMP interface. RavlinManager software, which is used to configure the Ravlin IPSec encryption card, uses the IP address to communicate with the board, while the Ravlin IPSec encryption card uses this address for the ESP tunnel address. Encapsulating Security Payload (ESP) is discussed in RFC 1827.

To set up a tunnel you must know not only the secret code for the Ravlin IPSec encryption card on your end, but also for the Ravlin IPSec encryption card on the other end. This will be a problem in the case of shared-network partnerships. Once the partner or company itself knows the secret code for the other party, they will be able to change their setup.

Note The Ravlin IPSec encryption card must be installed in the PIX Firewall before you use this command.

Example

The following example shows how a Ravlin IPSec encryption card is initialized on the PIX Firewall:

nameif ethernet0 outside security0
ip address outside 204.31.17.1 255.255.255.0
interface ethernet0 auto
tunnel ip outside 204.31.17.2 255.255.255.0

uauth (clear and show)

Delete all authorization caches for a user. (Privileged mode.)

clear uauth [username]
show uauth [username]

Syntax Description


username	Clear or view user authentication information by username.

Usage Guidelines

The clear uauth command deletes one user's or all users' authorization caches, which forces the user or users to reauthenticate the next time they create a connection. The show uauth command displays one or all currently authenticated users, the host IP to which they are bound, and, if applicable, any cached IP and port authorization information.

Each user host's IP address has an authorization cache attached to it. If the user attempts to access a service that has been cached from the correct host, the firewall considers it preauthorized and immediately unproxies the connection. This means that once you are authorized to access a web site, for example, the authorization server is not contacted for each of the images as they are loaded (assuming they come from the same IP address). This significantly increases performance and reduces load on the authorization server.

The cache allows up to 16 address and service pairs for each user host.

The output from show uauth displays the username provided to the authorization server for authentication and authorization purposes, the IP address that the username is bound to, and whether the user is authenticated only, or has cached services.

Use the timeout uauth command to specify how long the cache should be kept after the user connections become idle. The timeout value must be at least 2 minutes. Use clear uauth to delete all authorization caches for all users, which will cause them to have to reauthenticate the next time they create a connection.

See also: aaa authorization, timeout.

Example

show uauth
user `winifred' from 204.31.17.42 authenticated
user `pollyhedra' from 204.31.17.54 authorized to:
port 192.168.67.34/telnet 192.168.67.11/http192.168.67.33/tcp/8001
192.168.67.56/tcp/25192.168.67.42/ftp
user `brian' from 204.31.17.207 authorized to:
port 192.159.1.50/http192.150.50.69/http

In this example, user winifred has authenticated with the server but has not completed authorization. User pollyhedra has preauthorized connections to the Telnet, Web (HTTP), sendmail, FTP services, and to TCP port 8001 on 192.168.67.33.

User brian has been browsing the Web and is authorized for Web browsing to the two sites shown.

The next example causes users winifred to reauthenticate:

clear uauth winifred

url-cache

Cache responses to URL filtering requests to the WebSENSE server. (Configuration mode.)

url-cache dst|src_dst size
no url-cache dst|src_dst size
show url-cache stats

Syntax Description


dst	Cache entries based on the URL destination address. Select this mode if all users share the same URL filtering policy on the WebSENSE server.
src_dst	Cache entries based on the both the source address initiating the URL request as well as the URL destination address. Select this mode if users do not share the same URL filtering policy on the WebSENSE server.
size	Specify a value for the cache size within the range 1 to 128 KB.
stats	Use the stats option to display additional URL cache statistics, including the number of cache lookups and hit rate.

Usage Guidelines

The url-cache command caches responses to URL filtering requests to the WebSENSE server. Caching stores URL access privileges in memory on the PIX Firewall. When a host requests a connection, the PIX Firewall first looks in the URL cache for matching access privileges instead of forwarding the request to the WebSENSE server. Disable caching with the no url-cache command.

Note Access to the URL cache does not update the WebSENSE accounting logs. Before using this command, let WebSENSE run to accumulate logs to let you view WebSENSE accounting information. After you get a usage profile that meets your security needs, enable this command to increase throughput.

Note If you change settings on the WebSENSE server, disable the URL cache, and then restart it.

The url-cache command allows you to enable URL caching, set the size of the cache, and displays cache statistics.

The show url-cache command with the stats option displays the following entries:

Size---the size of the cache in kilobytes, set with the url-cache size option.
Entries---the maximum number of cache entries based on the cache size.
In Use---the current number of entries in the cache.
Lookups---the number of times the PIX Firewall has looked for a cache entry.
Hits---the number of times the PIX Firewall has found an entry in the cache.

You can view additional information about WebSENSE access with the show perfmon command.

Examples

The following example caches all outbound HTTP connections based on the source and destination addresses:

url-cache src_dst 128

The following example lists the show url-cache command:

show url-cache stats
 
URL Filter Cache Stats
----------------------
    Size : 1KB
 Entries : 36
In Use : 30
 Lookups : 300
    Hits : 290

url-server

Designate a server running WebSENSE for use with the filter command. (Configuration mode.)

url-server [(if_name)] host ip_address [timeout seconds]
no url-server host ip_address

Syntax Description


if_name	The network interface where the authentication server resides. If not specified, the default is inside.
host ip_address	The inside server that runs the WebSENSE URL filtering application.
timeout seconds	The maximum idle time permitted before PIX Firewall switches to the next server you specified. The default is 5 seconds.

Usage Guidelines

This command designates a server that runs WebSENSE, a URL filtering application. Once you designate the server, enable the URL filtering service with the filter command. You can specify up to 15 servers.

To filter URLs:

Step 1 Designate a WebSENSE server with the url-server command.

Step 2 Enable filtering with the filter command.

Step 4 Use the show url-cache stats and the show perfmon commands to view run information.

Additional information on WebSENSE is available at:

: http://www.websense.com

Example

The following example filters all outbound HTTP connections except those from the 10.0.2.54 host:

url-server (perimeter) host 10.0.1.1
filter url http 0 0 0 0
filter url except 10.0.2.54 255.255.255.255 0 0

virtual

Access PIX Firewall virtual server. (Configuration mode.)

virtual http ip_address [warn]
virtual telnet ip_address

Syntax Description


ip_address	For outbound use, ip_address must be an address routed to the PIX Firewall. Use an RFC 1918 address that is not in use on any interface. For inbound use, ip_address must be an unused global address. A conduit and static pair must provide access to ip_address, as well as an aaa authentication statement. Refer to the "Example" section for more information. For example, if an inside client at 192.168.0.100 has a default gateway set to the inside interface of the PIX Firewall at 192.168.0.1, the ip_address can be any IP address not in use on that segment (such as 10.2.3.4). As another example, if the inside client at 192.168.0.100 has a default gateway other than the PIX Firewall (such as a router at 192.168.0.254), then the ip_address would need to be set to a value that would get statically routed to the PIX Firewall. This might be accomplished by using a value of 10.0.0.1 for the ip_address, then on the client, setting the PIX Firewall at 192.168.0.1 as the route to host 10.0.0.1.
warn	Let virtual http users know that the command was redirected. This option is only applicable for text-based browsers where the redirect cannot happen automatically.

Usage Guidelines

virtual http lets web browsers work correctly with the PIX Firewall aaa command. The aaa command assumes that the AAA server database is shared with a web server. PIX Firewall automatically provides the AAA server and web server with the same information. The virtual http command works with the aaa command to authenticate the user, separate the AAA server information from the web client's URL request, and direct the web client to the web server. Use show virtual http to list commands in the configuration. Use no virtual http to disable its use.

The virtual http command works by redirecting the web browser's initial connection to the ip_address, which resides in the PIX Firewall, authenticating the user, then redirecting the browser back to the URL which the user originally requested. This mechanism comprises the PIX Firewall's new virtual server feature. The reason this command is named as it is, is because the virtual http command accesses the virtual server for use with HTTP, another name for the Web. This command is especially useful for PIX Firewall interoperability with Microsoft IIS, but is useful for other authentication servers.

When using HTTP authentication to a site running Microsoft IIS that has "Basic text authentication" or "NT Challenge" enabled, users may be denied access from the Microsoft IIS server. This occurs because the browser appends the string: "Authorization: Basic=Uuhjksdkfhk==" to the HTTP GET commands. This string contains the PIX Firewall authentication credentials.

Note If you want double authentication through the authentication and web browser, configure the authentication server to not accept anonymous connections.

Note Do not set the timeout uauth duration to 0 seconds when using the virtual command because this will prevent HTTP connections to the real web server.

Note For both the virtual http and virtual telnet commands, if the connection is started on either an outside or perimeter interface, a static and conduit command pair is required for the fictitious IP address.

virtual telnet allows the Virtual Telnet server to provide a way to pre-authenticate users who require connections through the PIX Firewall using services or protocols that do not support authentication.

If inbound users on either the perimeter or outside interfaces need access to the Virtual Telnet server, a static and conduit command pair must accompany use of virtual telnet. The global IP address in the static command must be a real IP address. The local address in the static command is the IP address of the virtual server.

The Virtual Telnet server provides a way to pre-authenticate users who require connections through the PIX Firewall using services or protocols that do not support authentication. Users first connect to the Virtual Telnet server IP address, where the user is prompted for a username and password.

Example: virtual http

The following example shows the commands required to use virtual http for an inbound connection:

static 204.31.17.1 192.168.1.1
conduit permit tcp host 204.31.17.1 eq 80 any
aaa authentication any inbound 192.168.1.1 255.255.255.255 0 0 tacacs+
virtual http 204.31.17.1

The next example displays the show virtual command output:

show virtual http
virtual http 204.31.17.1

Example: virtual telnet

After adding the virtual telnet command to the configuration and writing the configuration to Flash memory, users wanting to start PPTP sessions through PIX Firewall use Telnet to access the ip_address as shown in the following example:

On the PIX Firewall:

virtual telnet 204.31.17.254
static 204.31.17.254 10.8.8.11 netmask 255.0.0.0
conduit permit tcp host 204.31.17.254 eq telnet any
write memory

On an inside host:

/unix/host%telnet 204.31.17.254
Trying 204.31.17.254...
Connected to 204.31.17.254.
Escape character is `^]'.
 
username: username
 
TACACS+ Password: password
 
Authentication Successful
 
Connection closed by foreign host.
/unix/host%

The username and password are those for the user on the TACACS+ server.

who

Show active Telnet administration sessions on the PIX Firewall. (Unprivileged mode.)

who [local_ip]
show who [local_ip]

Syntax Description


local_ip	An optional internal IP address to limit the listing to one IP address or to a network IP address.

Usage Guidelines

The who command shows the PIX Firewall tty_id and IP address of each Telnet client currently logged into the PIX Firewall. This command is the same as the show who command.

Example

who
2: From 192.168.2.2
1: From 192.168.1.3

write

Store, view, or erase the current configuration. (Privileged mode.)

write net [[server_ip]:[filename]]
write erase
write floppy
write memory
write standby
write terminal

Syntax Description


server_ip	Store current configuration at a host available across the network. If you specify the full path and filename in the tftp-server command, only specify a colon (:) in the write command.
filename	A filename you specify to qualify the location of the configuration file on the TFTP server named in server_ip. If you set a filename with the tftp-server command, do not specify it in the write command; instead just use a colon (:) without a filename. Many TFTP servers require the configuration file to be world-writable to write to it.
erase	Clear the Flash memory configuration.
floppy	Store current configuration on diskette.
memory	Store current configuration in Flash memory.
standby	Store configuration to the failover Standby unit from RAM to RAM.
terminal	Display current configuration on the terminal.

Usage Guidelines

The write net command stores the current configuration into a file on a TFTP server elsewhere in the network. Additionally, write net uses the TFTP server IP address specified in the tftp-server command.

If you specify both the IP address and path name in the tftp-server command, you can specify the write net :filename as simply a colon (:); for example:

	write net :

Use the configure net command to get the configuration from the file.

The write erase command clears the Flash memory configuration.

The write floppy command stores the current configuration on diskette. The diskette must be DOS formatted or a PIX Firewall boot disk. If you are formatting the diskette from Windows, choose the Full format type, not the Quick (erase) selection. You can tell that information is stored on the diskette by observing that the light next to the diskette drive glows while information transfers.

The diskette you create can only be read or written by the PIX Firewall. If you use the write floppy command with a diskette that is not a PIX Firewall boot disk, do not leave the floppy in the floppy drive because it will prevent the firewall from rebooting in the event of a power failure or system reload. Only one copy of the configuration can be stored on a single diskette.

The write memory command saves the current running configuration to Flash memory. Use configure memory to merge the current configuration with the image you saved in Flash memory.

Note Only use the write memory command if a configuration has been created with IP addresses for both network interfaces.

The write standby command writes the configuration stored in RAM on the Active failover unit to the RAM on the Standby unit. When the Primary unit boots it automatically writes the configuration to the Secondary unit. Use the write standby command if the primary and secondary units' configurations have different information.

The write terminal command displays the current configuration in the PIX Firewall's RAM memory.

You can also display the configuration stored in Flash memory using the show configure command.

Examples

The following example specifies a configuration file on the TFTP server and then stores the configuration in this file:

tftp-server 10.1.1.2 /pixfirewall/config/new_config
write net :

The following example erases the contents of Flash memory and reloads the PIX Firewall:

write erase
Erase PIX configuration in Flash memory? [confirm] y
reload

The following example saves the configuration on diskette:

write floppy
Building configuration...
[OK]

The following example saves the current configuration to Flash memory:

write memory
Building configuration...
[OK]

The following example displays the configuration:

write terminal
Building configuration...
: Saved
:
...

xlate (clear and show)

View or clear translation slot information. (Privileged mode.)

clear xlate [global|local ip1[-ip2] [netmask mask]] lport|gport port[-port]]
[interface if1[,if2][,ifn]] [state static[,dump][,portmap][,norandomseq][,identity]]
show xlate [global|local ip1[-ip2] [netmask mask]] lport|gport port[-port]]
[interface if1[,if2][,ifn]] [state static[,dump][,portmap][,norandomseq][,identity]]

Syntax Description


[global\|local ip1[-ip2] [netmask mask]	Display active translations by global IP address or local IP address using the network mask to qualify the IP addresses.
lport\|gport port[-port]	Display active translations by local and global port specifications. Refer to the "Ports" section in Chapter 1, "Introduction" for a list of valid port literal names.
interface if1[,if2][,ifn]	Display active translations by interface.
state	Display active translations by state; static translation (static), dump (cleanup), PAT global (portmap), a nat or static translation with the norandomseq setting (norandomseq), or the use of the nat 0, identity feature (identity).

Usage Guidelines

The clear xlate command clears the contents of the translation slots. ("xlate" means translation slot.) New to version 4.2(3), the show xlate command displays the contents of only the translation slots. In version, 4.2(2), this command also listed the connection slot information now described on the show conn command page.

Translation slots can persist indefinitely after key changes have been made. Always use clear xlate or reload after adding, changing, or removing alias, conduit, global, nat, route, or static commands in your configuration.

Table 5-5 lists translation slot flags:

Table 5-5: Translation Slot Flags

Flag Description

d

Dump.

H

H.323 translation.

i

Translation inbound data.

I

Identity translation. The identity feature is started with the nat 0 command and specifies that NAT is disabled.

n

TCP translations (packets) through this translation slot do not have their sequence numbers randomized. Set with the norandomseq option to the nat or static commands.

r

Port Address Translation (PAT) xlate.

R

RPC translation.

s

Static translation.

S

SQL*Net fixup.

See also: show conn, timeout, uauth.

Example

The following example lists two static translations, the first with two associated connections (called "nconns") and the second with four.

show xlate
Global 16.130.3.17 Local 16.130.3.17 static nconns 1 econns 0 flags s
Global 16.130.3.16 Local 16.130.3.16 static nconns 4 econns 0 flags s

From This Interface	To This Interface	Use This Command	From This Interface	To This Interface	Use This Command
inside	outside	nat	dmz2	outside	nat
inside	dmz1	nat	dmz2	dmz1	nat
inside	dmz2	nat	dmz2	inside	static
dmz1	outside	nat	outside	dmz1	static
dmz1	dmz2	static	outside	dmz2	static
dmz1	inside	static	outside	inside	static

PERFMON STATS:	Current	Average
Xlates	33/s	20/s
Connections	110/s	10/s
TCP Conns	50/s	42/s
WebSns Req	4/s	2/s
TCP Fixup	20/s	15/s
HTTP Fixup	5/s	5/s
FTP Fixup	7/s	4/s
AAA Authen	10/s	5/s
AAA Author	9/s	5/s
AAA Account	3/s	3/s

Connection Flag	Description
d	Dump, clean up connection.
f	FIN seen in inbound packet.
F	FIN seen in outbound packet.
H	HTTP get. If a UDP connection, H can also mean H.323.
I	Data in.
J	Java applets are not permitted on connection.
m	SMTP data.
O	Data out.
q	SQL*Net data fixup.
R	RPC
r	In use.
U	Connection is up.

Flag	Description
d	Dump.
H	H.323 translation.
i	Translation inbound data.
I	Identity translation. The identity feature is started with the nat 0 command and specifies that NAT is disabled.
n	TCP translations (packets) through this translation slot do not have their sequence numbers randomized. Set with the norandomseq option to the nat or static commands.
r	Port Address Translation (PAT) xlate.
R	RPC translation.
s	Static translation.
S	SQL*Net fixup.

Table of Contents

Command Reference

Syntax Description

Usage Guidelines

Usage Notes

Syntax Description

Usage Guidelines

Examples

Syntax Description

Usage Guidelines

Examples

Syntax Description

Usage Guidelines

Example

Usage Guidelines

Usage Notes

Examples

Syntax Description

Usage Guidelines

Example

Syntax Description

Usage Guidelines

Trace Channel Feature

Additional debug Command Information

Examples

Usage Guidelines

Example

Usage Guidelines

Example

Syntax Description

Usage Guidelines

Examples

Syntax Description

Usage Guidelines

Security Problem

Examples

Usage Guidelines

Example

Syntax Description

Usage Guidelines

Usage Notes

Examples

Syntax Description

Usage Guidelines

Example

Syntax Description

Usage Guidelines

Examples

Syntax Description

Usage Guidelines

Example

Syntax Description

Usage Guidelines

Usage Notes

Examples

Usage Guidelines

Example

Syntax Description

Usage Guidelines

Example

Syntax Description

Usage Guidelines

Usage Notes

show interface Notes

Example

Syntax Description

Usage Guidelines

Example

Syntax Description

Usage Guidelines

Example

Syntax Description

Usage Guidelines

Usage Notes

Examples

Syntax Definition

Usage Guidelines

Viewing Syslog Messages from the Console

Viewing Syslog Messages from a Telnet Console Session

Sending Syslog Messages to a Syslog Server