Blocking Specific IPs on Outside

[jdubbish]

I have been getting a large number of FTP requests from various IPs. I have setup an entry in my Access List to Deny all traffic originating from a specific IP on the outside, however, for some reason the traffice from this IP is still being allowed, and I can still see the FTP requests getting to my server.

Any ideas on what would cause this to be ignored?

Running configuration:

Building configuration...
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password bx.pWzU74kWjig/3 encrypted
passwd bx.pWzU74kWjig/3 encrypted
hostname aptfw
domain-name aptfw.com
clock timezone CST -6
clock summer-time CDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 1.1.1.1 HTTPADDR
name 2.2.2.2 BlockFTP2
name 3.3.3.3 BlockFTP1
access-list outside_access_in deny ip host BlockFTP2 host HTTPADDR
access-list outside_access_in deny tcp any any eq smtp
access-list outside_access_in permit tcp any any eq pptp
access-list outside_access_in permit gre any any
access-list outside_access_in permit tcp any any eq www
access-list outside_access_in permit tcp any any eq 1433
access-list outside_access_in permit tcp any any eq 1434
access-list outside_access_in permit tcp any any eq ftp
access-list inside_access_in permit ip any any
pager lines 24
logging on
logging timestamp
logging trap informational
logging device-id ipaddress inside
logging host inside 10.10.10.250
icmp deny any echo-reply outside
mtu outside 1500
mtu inside 1500
ip address outside 1.1.1.1 255.255.240.0
ip address inside 10.10.10.10 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 10.10.10.0 255.255.255.0 inside
pdm location 10.10.10.2 255.255.255.255 inside
pdm location 10.10.10.250 255.255.255.255 inside
pdm location 10.10.10.251 255.255.255.255 inside
pdm location HTTPADDR 255.255.255.255 outside
pdm location BlockFTP1 255.255.255.255 outside
pdm location BlockFTP2 255.255.255.255 outside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp 1.1.1.2 pptp 10.10.10.250 pptp netmask 255.255.255.255 0 0
static (inside,outside) tcp HTTPADDR

http://www 10.10.10.251

http://www netmask

255.255.255.255 0 0
static (inside,outside) tcp 1.1.1.2 1433 10.10.10.251 1433 netmask 255.255.255.255 0 0
static (inside,outside) udp interface 1434 10.10.10.251 1434 netmask 255.255.255.255 0 0
static (inside,outside) tcp HTTPADDR ftp 10.10.10.251 ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp HTTPADDR smtp 10.10.10.251 smtp netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 64.1.1.1 2
route outside HTTPADDR 255.255.255.255 64.1.1.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 0.0.0.0 0.0.0.0 inside
http 10.10.10.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-pptp
crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
telnet 10.10.10.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
management-access inside
console timeout 0
dhcpd auto_config outside
terminal width 80
Cryptochecksum:REMOVED
: end
[OK]

 

[Supergrrover]

It looks like it should be blocking - what do the logs say?



Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[jdubbish]

I haven't actually found a reasonable way of logging traffic yet. So far the logs I'm viewing are the PDM logs only....any suggestions on setting those logs up would be helpful.

I just viewed my server's logs and it looks like that request from that IP have stopped, but it seems as if it's taking 15-30 minutes for the new access rules to take affect. Is this normal with the PIX 501?

With all of the networking I've done in the past, and the devices I've worked with, any changes similar to this were instantaneous.

 

[Supergrrover]

Kiwi syslog server is good.

The change should be immediate (maybe clearing the existing translations if there is an existing connection.)


Brent
Systems Engineer / Consultant
CCNP, CCSP