PIX 515E dietro ROUTER

[devid79]

Salve a tutti

sono nuovo di questo forum, sinceramente già mi piace ho trovato tantissime notizie e info utili, essendo novizio in ambito cisco, ma lavorandoci tutti i giorni, mi sono comprato per casa un pix515e da utilizzare come firewall in modo da stare alquanto tranquilli....

mi posto la mappa di rete e la configurazione di seguito, avrei necessita di capire come bloccare tutto il traffico in entrata se non autorizzato.

HO LETTO E RIPROVATO IN TUTTI I MODI ANCHE VIA ASDM MA NON CI RIESCO PER FAVORE AIUTATEMI VOGLIO SOLO BLOCCARE IL TRAFFICO IN ENTRATA E ABILITARE LE PORTE CHE SERVONO ALLA LAN QUANDO MI SERVONO TUTTO QUI

AD ORA NAVIGO TRANQUILLAMENTE E LE RETI LAN SI VEDONO TRA DI LORO GRAZIE A TUTTI COLORO CH EMI AIUTERANNO A CAPIRE ANCHE CON ESEMPI COME BLOCCARE TUTTO IL TRAFFICO E POI ABILITARE LE SINGOLE PORTE O INTERVALLI DI PORTE CHE MI SERVONO


PixFirewall# sh conf
: Saved
: Written by enable_15 at 00:17:18.772 CEST Thu Jan 5 2012
!
PIX Version 8.0(4)28
!
hostname PixFirewall
domain-name homenet.dyndns.org
enable password 0rh.oQUqqEQVpDRZ encrypted
passwd A3sLTDqGVMidVPx3 encrypted
names
!
interface Ethernet0
speed 100
duplex full
nameif outside
security-level 0
ip address 192.168.1.253 255.255.255.0
ospf cost 10
!
interface Ethernet1
speed 100
duplex full
nameif inside
security-level 100
ip address 192.168.100.1 255.255.255.0
ospf cost 10
!
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet5
shutdown
no nameif
no security-level
no ip address
!
boot system flash:/pix804.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
domain-name itaca-homenet.dyndns.org
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list inside_access_in extended permit ip any any
access-list allow_ping extended permit icmp any any
access-list Outside_access_out extended permit ip any any
access-list Outside_access_out extended permit icmp any any
access-list acl-out extended permit icmp any any
pager lines 24
logging enable
logging buffered informational
logging from-address [email protected]
logging recipient-address [email protected] level emergencies
logging debug-trace
mtu outside 1500
mtu inside 1500
ip verify reverse-path interface inside
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm-61551.bin
no asdm history enable
arp timeout 14400
global (outside) 1 192.168.1.254
global (outside) 10 interface
nat (inside) 10 192.168.100.0 255.255.255.0
access-group acl-out in interface outside
access-group Outside_access_out out interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 192.168.1.254 1
timeout xlate 0:45:00
timeout conn 0:15:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 0.0.0.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=PixFirewall
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate c6b9034f
3082020d 30820176 a0030201 020204c6 b9034f30 0d06092a 864886f7 0d010104
0500304b 31143012 06035504 03130b50 69784669 72657761 6c6c3133 30310609
2a864886 f70d0109 02162450 69784669 72657761 6c6c2e69 74616361 2d686f6d
656e6574 2e64796e 646e732e 6f726730 1e170d31 32303130 34303233 3033305a
170d3232 30313031 30323330 33305a30 4b311430 12060355 0403130b 50697846
69726577 616c6c31 33303106 092a8648 86f70d01 09021624 50697846 69726577
616c6c2e 69746163 612d686f 6d656e65 742e6479 6e646e73 2e6f7267 30819f30
0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00c850be 37c0e98d
f3e3a201 7f8b317e 1de215e6 9b634cb5 94319319 0a9e8d54 07252f10 42ec86e5
edb00b2c 5fc452d3 bc187cb1 a6a3fad9 4c2e9723 93be27ee 8bc3e72d 82faafc4
ff47d9e5 5bc504da ca35ecd8 3d27daed 6ecfbccc 6bdfcdb1 17bb6a9e bffae4a9
f0184f18 47477b4c 94e3f37d f7382611 a139552a cd7ed8fe fb020301 0001300d
06092a86 4886f70d 01010405 00038181 0073f3be f8432422 0082e784 b7ca1c59
406de080 6c9a90a8 7ee0a29b b5e1acf0 89614ad5 b18fb101 992f0249 cd2fb0de
77436ff6 3225a2e2 f5ee57ac 38393c8a 2f24f932 c3110749 f798eb90 157c3431
ba5e3c9e 488298b3 c4189689 983cd5d0 211b67be fe6047cb 5c2aefbd 2c102e7e
56148e95 b67ad736 d129bf56 d74baa6a b7
quit
crypto isakmp enable inside
crypto isakmp policy 10
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
telnet 0.0.0.0 255.255.255.0 inside
telnet timeout 30
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 255.255.255.0 inside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 30
console timeout 0
management-access inside
dhcpd dns 208.67.222.222 208.67.220.200
dhcpd ping_timeout 750
dhcpd domain homenet.dyndns.org
!
dhcpd address 192.168.100.10-192.168.100.250 inside
dhcpd dns 208.67.222.222 208.67.220.200 interface inside
dhcpd domain homenet.dyndns.org interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection scanning-threat
threat-detection statistics
threat-detection statistics host number-of-rate 3
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 193.204.114.232 source outside prefer
username cisco password qxoWq.jBD8rt62Db encrypted
!
class-map class_sqlnet
match port tcp eq 152
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect http
inspect ils
inspect dns preset_dns_map
class class_sqlnet
inspect sqlnet
!
service-policy global_policy global
smtp-server 82.57.200.132
prompt hostname context
Cryptochecksum:62d2c230d20b819b6a7b7486c57617ef
PixFirewall#

[Rizio]

Con quello che vuoi fare tu Cisco di per sè centra poco perchè in realtà ti servono le basi di networking. Prenditi un libro sull'argomento e leggiti un pò di pagine in rete per capire in cosa consiste e come devi configurarlo per le tue esigenze, fatto questo non devi fare altro che applicarle alle acl e dopo applichi le acl alle interfacce del PIX.
La sintassi è banale anche perchè nella conf hai già buona parte del lavoro impostato e se usi l'asdm (o qualsiasi configuratore grafico presente su quel pix) ce la fai tranquillamente.

Rizio

[devid79]

Grazie della risposta

sono riuscito a configurare le acl
ma ho un dubbio che di seguito ti mostro


access-list inside_access_in extended permit tcp any any eq www
access-list inside_access_in extended permit tcp any any eq 8080
access-list inside_access_in extended permit tcp any any eq ftp
access-list inside_access_in extended permit tcp any any eq ssh
access-list inside_access_in extended permit tcp any any eq telnet
access-list inside_access_in extended permit tcp any any eq smtp
access-list inside_access_in extended permit tcp any any eq pop3
access-list inside_access_in extended permit tcp any any eq https
access-list inside_access_in extended permit tcp any any eq 993
access-list inside_access_in remark Additional Ports for Call of Duty
access-list inside_access_in extended permit udp any any eq 1500
access-list inside_access_in remark Additional Ports for Call of Duty
access-list inside_access_in extended permit udp any any range 3005 3101
access-list inside_access_in extended permit tcp any any eq 5223
access-list inside_access_in extended permit tcp any any eq 5900
access-list inside_access_in extended permit udp any any eq 5900
access-list inside_access_in extended permit tcp any any eq 6881
access-list inside_access_in extended permit udp any any eq 6881
access-list inside_access_in extended permit tcp any any eq 3074
access-list inside_access_in extended permit udp any any eq 3074
access-list inside_access_in remark Steam downloads
access-list inside_access_in extended permit tcp any any range 27014 27050
access-list inside_access_in remark Typically Matchmaking and HLTV
access-list inside_access_in extended permit udp any any range 27015 27030
access-list inside_access_in extended permit tcp any any range 10070 10080
access-list inside_access_in extended permit udp any any range 10070 10080
access-list inside_access_in extended permit udp any any eq 3478
access-list inside_access_in remark Steamworks P2P Networking and Steam Voice Chat
access-list inside_access_in extended permit udp any any range 4379 4380
access-list inside_access_in extended permit tcp any any range 3074 3658
access-list inside_access_in extended permit udp any any range 3074 3658
access-list inside_access_in extended permit ip any any
perchè se ometto questa stringa non naviga più anche se ho creato tutte le acl?
non riesco a capire aiutatemi

access-list outside_access_in extended permit ip any any
access-list allow_ping extended permit icmp any any
access-list Outside_access_out extended permit ip any any
access-list Outside_access_out extended permit icmp any any
access-list acl-out extended permit icmp any any

[Rizio]

Mah, da vedere così non mi sembra corretto, teoricamente dovresti navigare tranquillamente e la riga da te evidenziata non deve proprio esserci per fare le cose fatte bene.....

Posta l'output di uno

Codice: Seleziona tutto

sh run | i include

e uno

Codice: Seleziona tutto

sh access-l inside_access_in

Rizio

P.S. Dopo il "run" e prima della "i" il simbolo è un pipe ("|"), se copi/incolli non dovrestia vere nessun problema

[devid79]

di seguito ciò che mi hai chiesto di fatti senza quella riga il mio pc non va in internet etccc


PixFirewall# sh access-l inside_access_in
access-list inside_access_in; 27 elements
access-list inside_access_in line 1 extended permit tcp any any eq www (hitcnt=1740) 0x386bad81
access-list inside_access_in line 2 extended permit tcp any any eq 8080 (hitcnt=978) 0x448c3b8c
access-list inside_access_in line 3 extended permit tcp any any eq ftp (hitcnt=44) 0xd04b582a
access-list inside_access_in line 4 extended permit tcp any any eq ssh (hitcnt=1) 0x6f607596
access-list inside_access_in line 5 extended permit tcp any any eq telnet (hitcnt=0) 0xa019e86c
access-list inside_access_in line 6 extended permit tcp any any eq smtp (hitcnt=0) 0xc376b9f1
access-list inside_access_in line 7 extended permit tcp any any eq pop3 (hitcnt=0) 0xf595b5a2
access-list inside_access_in line 8 extended permit tcp any any eq https (hitcnt=470) 0x6908ba56
access-list inside_access_in line 9 extended permit tcp any any eq 993 (hitcnt=45) 0x0e721456
access-list inside_access_in line 10 remark Additional Ports for Call of Duty
access-list inside_access_in line 11 extended permit udp any any eq 1500 (hitcnt=0) 0x6a2a3146
access-list inside_access_in line 12 remark Additional Ports for Call of Duty
access-list inside_access_in line 13 extended permit udp any any range 3005 3101 (hitcnt=4) 0x4dcb6ea0
access-list inside_access_in line 14 extended permit tcp any any eq 5223 (hitcnt=0) 0xc1eaa1ab
access-list inside_access_in line 15 extended permit tcp any any eq 5900 (hitcnt=3) 0x558f8232
access-list inside_access_in line 16 extended permit udp any any eq 5900 (hitcnt=0) 0xec72b40b
access-list inside_access_in line 17 extended permit tcp any any eq 6881 (hitcnt=1038) 0x86278573
access-list inside_access_in line 18 extended permit udp any any eq 6881 (hitcnt=501) 0xd18cae8a
access-list inside_access_in line 19 extended permit tcp any any eq 3074 (hitcnt=2) 0xe13e27d4
access-list inside_access_in line 20 extended permit udp any any eq 3074 (hitcnt=0) 0x8ee797e1
access-list inside_access_in line 21 remark Steam downloads
access-list inside_access_in line 22 extended permit tcp any any range 27014 27050 (hitcnt=42) 0xc4fb8a1a
access-list inside_access_in line 23 remark Typically Matchmaking and HLTV
access-list inside_access_in line 24 extended permit udp any any range 27015 27030 (hitcnt=123) 0xa694cbcb
access-list inside_access_in line 25 extended permit tcp any any range 10070 10080 (hitcnt=0) 0xc0fc1e8e
access-list inside_access_in line 26 extended permit udp any any range 10070 10080 (hitcnt=4) 0xd30dd487
access-list inside_access_in line 27 extended permit udp any any eq 3478 (hitcnt=0) 0x80524c9a
access-list inside_access_in line 28 remark Steamworks P2P Networking and Steam Voice Chat
access-list inside_access_in line 29 extended permit udp any any range 4379 4380 (hitcnt=0) 0xb1aeecfb
access-list inside_access_in line 30 extended permit tcp any any range 3074 3658 (hitcnt=135) 0x0bb7ba3f
access-list inside_access_in line 31 extended permit udp any any range 3074 3658 (hitcnt=25) 0xb5911ba5
access-list inside_access_in line 32 extended permit ip any any (hitcnt=35709) 0xa925365e

[Rizio]

Manca il dns, per quello non navighi.
Dai un

Codice: Seleziona tutto

access-list inside_access_in line 1 extended permit udp any any eq 53
access-list inside_access_in line 2 extended permit tcp any any eq 53
no access-list inside_access_in line 34 extended permit ip any any

(la riga che dici tu dovrebbe scalare alle 34esima posizione se inserisci le prime 2 senza altre righe di commenti)


Manca l'output dello "sh run | i include" ma secondo me dovremmo aver risolto comunque.

Rizio

[devid79]

cosi di seguito la riga quella che avevo evidenziato è stata rimossa

e di fatti navigo quindi vengo presi in cosiderazione le acl create?
di fatti il pc mio caro naviga non sai quanto mi hai reso felice
ora creo le statiche coem di seguito per l'ftp server:

static (inside,outside) tpc interface 21 192.168.100.50 21 netmask 255.255.255.255 0 0

e di seguito ti allego situazione attuale

PixFirewall(config)# sh access-l inside_access_in
access-list inside_access_in; 28 elements
access-list inside_access_in line 1 extended permit udp any any eq domain (hitcnt=34) 0xcf394c76
access-list inside_access_in line 2 extended permit tcp any any eq domain (hitcnt=0) 0x88d26f2a
access-list inside_access_in line 3 extended permit tcp any any eq www (hitcnt=2030) 0x386bad81
access-list inside_access_in line 4 extended permit tcp any any eq 8080 (hitcnt=978) 0x448c3b8c
access-list inside_access_in line 5 extended permit tcp any any eq ftp (hitcnt=48) 0xd04b582a
access-list inside_access_in line 6 extended permit tcp any any eq ssh (hitcnt=1) 0x6f607596
access-list inside_access_in line 7 extended permit tcp any any eq telnet (hitcnt=0) 0xa019e86c
access-list inside_access_in line 8 extended permit tcp any any eq smtp (hitcnt=0) 0xc376b9f1
access-list inside_access_in line 9 extended permit tcp any any eq pop3 (hitcnt=0) 0xf595b5a2
access-list inside_access_in line 10 extended permit tcp any any eq https (hitcnt=519) 0x6908ba56
access-list inside_access_in line 11 extended permit tcp any any eq 993 (hitcnt=69) 0x0e721456
access-list inside_access_in line 12 remark Additional Ports for Call of Duty
access-list inside_access_in line 13 extended permit udp any any eq 1500 (hitcnt=0) 0x6a2a3146
access-list inside_access_in line 14 remark Additional Ports for Call of Duty
access-list inside_access_in line 15 extended permit udp any any range 3005 3101 (hitcnt=5) 0x4dcb6ea0
access-list inside_access_in line 16 extended permit tcp any any eq 5223 (hitcnt=0) 0xc1eaa1ab
access-list inside_access_in line 17 extended permit tcp any any eq 5900 (hitcnt=3) 0x558f8232
access-list inside_access_in line 18 extended permit udp any any eq 5900 (hitcnt=0) 0xec72b40b
access-list inside_access_in line 19 extended permit tcp any any eq 6881 (hitcnt=1607) 0x86278573
access-list inside_access_in line 20 extended permit udp any any eq 6881 (hitcnt=618) 0xd18cae8a
access-list inside_access_in line 21 extended permit tcp any any eq 3074 (hitcnt=2) 0xe13e27d4
access-list inside_access_in line 22 extended permit udp any any eq 3074 (hitcnt=0) 0x8ee797e1
access-list inside_access_in line 23 remark Steam downloads
access-list inside_access_in line 24 extended permit tcp any any range 27014 27050 (hitcnt=55) 0xc4fb8a1a
access-list inside_access_in line 25 remark Typically Matchmaking and HLTV
access-list inside_access_in line 26 extended permit udp any any range 27015 27030 (hitcnt=185) 0xa694cbcb
access-list inside_access_in line 27 extended permit tcp any any range 10070 10080 (hitcnt=0) 0xc0fc1e8e
access-list inside_access_in line 28 extended permit udp any any range 10070 10080 (hitcnt=5) 0xd30dd487
access-list inside_access_in line 29 extended permit udp any any eq 3478 (hitcnt=0) 0x80524c9a
access-list inside_access_in line 30 remark Steamworks P2P Networking and Steam Voice Chat
access-list inside_access_in line 31 extended permit udp any any range 4379 4380 (hitcnt=0) 0xb1aeecfb
access-list inside_access_in line 32 extended permit tcp any any range 3074 3658 (hitcnt=135) 0x0bb7ba3f
access-list inside_access_in line 33 extended permit udp any any range 3074 3658 (hitcnt=32) 0xb5911ba5

[Rizio]

e di fatti navigo quindi vengo presi in cosiderazione le acl create?[/code]

Si, e se non ci credi togli la riga 3 e prova ad accedere a qualche sito in http ed in ftp. Il primo non andrà ed il secondo si.

ora creo le statiche coem di seguito per l'ftp server:

static (inside,outside) tpc interface 21 192.168.100.50 21 netmask 255.255.255.255 0 0

Ok, ricordati di creare la relativa acl in outside (ed eventualmente inside se è il caso) e poi "alla via così".

Ciao
Rizio

[devid79]

Sei un grande.....ciò perso notti ed erano i dns che vitaccia meno male che ci sono persone come te
Grazie
Grazie

[Rizio]

Prego, no problem, si fà un pò per uno al mondo