Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Chriss Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Recent content by NetworkGhost
-
PIX - logmein service listens on what port?
Im pretty sure logmein uses http and https tunneling. At that point you have 2 choices. Use a proxy or content server to filter, find the IP addresses of all the logmein servers and block by IP or use and IDS appliance to drop the packets. What version of PIX code are you running...- NetworkGhost
- Post #2
- Forum: Security, hacker detection & forensics
-
Allow routing via Site-Site VPN for VPN clients
Make sure you have this command on the ASA and also ass the VPN Client traffic to the site to site match acl same-security-traffic permit intra-interface http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080734db7.shtml#t3 http://www.wr-mem.com- NetworkGhost
- Post #2
- Forum: Security, hacker detection & forensics
-
VPN connects but wont route between LAN and client
Post the scrubbed config. Looks like you are using acl authorization. Do you have a ACS server? http://www.wr-mem.com- NetworkGhost
- Post #2
- Forum: Security, hacker detection & forensics
-
VPN -PIX 6.3 shows a QM_IDLE status when I do a show crypto isakmp sa
This ACL: access-list 101 deny ip 192.168.0.0 0.0.255.255 any means allow no one from the 192.168.0.0 network to flow. If the router is the internet router than this ACL should not be the problem. Just out of curiosity is there anyway that the router in front of the remote end is blocking ip...- NetworkGhost
- Post #6
- Forum: Security, hacker detection & forensics
-
VPN -PIX 6.3 shows a QM_IDLE status when I do a show crypto isakmp sa
Get the following info from both sides show crypto ipsec sa ping a server that should be accessible through the VPN and get the SAs again show cry ipsec sa When you do your ping, send 500 requests so we can expect to see the decrypt and encrypt counters increment. This will tell us if...- NetworkGhost
- Post #4
- Forum: Security, hacker detection & forensics
-
Internal Server not working to the outside world
Did you leave out the nat rules also? Please post whatever you left out. you also said that the ICMP traffic stops at the inside interface of the PIX "It stops at the inside interface of the PIX. " If this traffic is destined for Vlan5 than you shouldnt see traffic hitting the DMZ right...- NetworkGhost
- Post #6
- Forum: Security, hacker detection & forensics
-
Internal Server not working to the outside world
Few problems here. Let me know if I over looked. These are the hosts you want the outside world to access right? access-list acl_outside permit tcp any host 205.143.139.34 eq domain access-list acl_outside permit udp any host 205.143.139.34 eq domain access-list acl_outside permit tcp any host...- NetworkGhost
- Post #4
- Forum: Security, hacker detection & forensics
-
Cisco VPN Client on Vista Split Tunnelling
Where did you find this out? Was just curious if you got this from Cisco or not. http://www.wr-mem.com- NetworkGhost
- Post #4
- Forum: Security, hacker detection & forensics
-
date and time not retained
Sounds like it. If you have smartnet you can probably geta replacement sent: http://cio.cisco.com/en/US/docs/security/pix/pix63/hw/installation/guide/501.html#wp1123990 http://www.wr-mem.com- NetworkGhost
- Post #2
- Forum: Security, hacker detection & forensics
-
Internal Server not working to the outside world
Post a scrubbed config. Also post the output of a show log when this happens. If you dont have logging to the buffer enabled, enable by the following loggin on logging buffered 6 http://www.wr-mem.com- NetworkGhost
- Post #2
- Forum: Security, hacker detection & forensics
-
ISP routing two discontiguous subnets; can PIX 501 handle that?
Yeah, I was joking a bit with my comment. :) I think you got the idea. Basically if you could not place these servers off the PIX inside interface and do one to one nat then you could put the devices behind the router and just route the forward the range from the PIX to the router. Yes I am...- NetworkGhost
- Post #4
- Forum: Security, hacker detection & forensics
-
In over my head
Wont be doing one this weekend. I'll make a post for the next one and will also update my site when I do. Just got off vacation and have been pretty busy since. http://www.wr-mem.com- NetworkGhost
- Post #5
- Forum: Security, hacker detection & forensics
-
In over my head
Need more info to help you. If youd like send me a email: joe_at_wr-mem.com http://www.wr-mem.com- NetworkGhost
- Post #2
- Forum: Security, hacker detection & forensics
-
VPN -PIX 6.3 shows a QM_IDLE status when I do a show crypto isakmp sa
The idle state means that the SA is established and isnt doing anything until the SA needs to be rebuilt. This is a good thing. http://www.wr-mem.com- NetworkGhost
- Post #2
- Forum: Security, hacker detection & forensics
-
PIX 515E to ASA5510 vpn tunnel was working great...
What does the IPSEC SA look like? Do you see the encrypted count incrementing? decrypted? If you enable logging logging buffered 6 and so a show log, do the logs display any errors when you try the VPN traffic? http://www.wr-mem.com- NetworkGhost
- Post #2
- Forum: Security, hacker detection & forensics
