501 Configuration Support

[TVVV]

Since I am new to the PIX world, I am going to use PDM to configure my 501. I am using PAT (I only have one outside address). I also am need to setup a static route to my W2K server (192.168.1.2) running Terminal Services (TCP port 3389) and my workstation (192.168.1.10) running PCAnywhere (TCP ports 5631 and 5632). My IP address on my DSL connection is 24.144.43.104. I need to make these available to my software provide for remote support. His IP address changes sometime due to DHCP reassigning his address.

In case PDM does not fully support this configuration, I am trying to get the correct syntax to input this via the CLI. Any suggestions would be greatly appreciated.

 

[yizhar]

HI.

* You can find most of the info in Cisco web site:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/

http://www.cisco.com/warp/public/110/pix_command_ref.shtml

http://www.cisco.com/warp/public/110/top_issues/pix/pix_index.shtml

* It is best to use the pix with more then a single registered ip address on the outside, however it can also work with a single ip address.
Ask your ISP if you can get a range of 8 registered ip addresses.

* Unlike previous versions, the new pix 501 comes preconfigured with default settings, which are documented in its manual. If you wish, you can use this configuration as a baseline.

* You can use pixcript for the initial configuration or for generating sample CLI commands for specific task like VPN:

http://teachers.sivan.co.il/yizhar#pixcript

Port forwarding is currently not supported in this program.

* You should limit the access to your TS and PCAW hosts.

This can be done with access-list that will permit only known ip address or range of the support personal. If the remote ip changes but is still within a known specific range than this is a good option.
If the remote party is behind a NAT device, you can ask him to visit this page

http://www.showmyip.com

Or to ask his network administrator for the registered ip range in use.

Another option is using VPN (either IPSEC or PPTP).

In any case you should have real passwords at the server and at the PCAW host configuration.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[pcman1987]

I have a pix 501. at two different sites. I want to be able to use RDP from one pc site to another. I have a pix on both sites. Can someone please tell me what statements I should on my pix config on both sites.

greatly appreciated.

pcman1987