Pix 506e Questions

[Xanjiin]

Hello, I have a few questions about configuring the 506e. First of all, let me provide some background information.

We have a full T1 coming into our building through a 2500 series router. The router's ethernet is connected to a switch, where several "locked-down" servers sit for general Internet use (DNS, SMTP, WWW, etc). The router, along with the servers, use public (assigned) ip addresses.

Additionally, we have a firewalled computer used for NAT. Behind it, are a number of workstations (10.0.0.1-10.0.0.254 netmask 255.0.0.0). They access the Internet without a problem when their gateway is set to the NAT's inside IP ADDRESS 10.0.0.220.

I would like to add the PIX 506e so that it would replace the NAT and allow for additional functionalities (see below). However, I'm having a problem with the following configuration.

PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password uvDANr6dGSsRpZZC encrypted
passwd 5BWBHZZRhn.rUN9e encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
no pager
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside 206.135.27.10 255.255.255.224
ip address inside 10.0.0.10 255.0.0.0
ip audit info action alarm
ip audit attack action alarm
pdm location 10.0.0.103 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 206.135.27.1 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.0.0.103 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
no sysopt route dnat
telnet timeout 5
ssh 10.0.0.103 255.255.255.255 inside
ssh timeout 30
terminal width 160
Cryptochecksum:70132d9c76cbad764426c63f5abf014b

I can open a secure shell to the PIX and ping addresses successfully on both inside and outside interfaces:

pixfirewall# ping inside 10.0.0.1
pixfirewall# ping outside 66.218.71.89 (

http://www.yahoo.com)

But, I cannot ping through the PIX from a workstation on the network. The workstation's TCP/IP settings are set as follows:

IP ADDRESS: 10.0.0.241
SUBNET: 255.0.0.0
GATEWAY: 206.135.27.1 (public gateway)
DNS: 10.0.0.220 (inside DNS)

Is the workstation set up correctly? What's wrong with the 506e configuration?

Also, we are planning to set up VPN's to several locations, so that users at these locations may access resources here. The remote locations will be using PIX 501's. Can anyone provide a sample configuration for both the 506e and 501?

I've used Cisco IOS and am familiar with networking protocols, ports, etc. But, for some reason, I can't get the workstations to access through the PIX firewall.

Any feedback is appreciated!

 

[baddos]

Can your workstations ping the "10.0.0.10" PIX IP Address?

 

[Xanjiin]

Yes, they can ping the inside interface of the PIX (10.0.0.10).

I guess I'm a little confused as to how the packets get routed through the PIX, if the PIX doesn't act as a router. If the inside interface of the PIX is 10.0.0.10 and the outside interface of the PIX is 206.135.27.10, how are the workstations going to know how to get to 206.135.27.0 without using the PIX's inside ip address as the default gateway?

 

[baddos]

The PIX isn't a router, but it does route. It's hard to explain, but what they mean by that is that I can't do much routing.

You workstations should be using the PIX's inside interface as their default route. The pix will route through itself, but won't act as a "router on a stick". In other words, it won't do route redirection on the same interface.

 

[Xanjiin]

Got it working. Looks like the default configuration does not allow workstations to ping through it. I mistakingly thought it wasn't working because I was testing by trying to ping outside addresses from a workstation.

When I opened up the browser and tried viewing an outside website, everything worked fine.

Now, I have been able to establish a VPN connection between our main location (PIX506e) and an off-site location (PIX501), using the VPN Wizard in PDM. The VPN tunnel looks like it's active, but I couldn't access resources behind either one.

Reading up on access-lists now...

 

[Xanjiin]

Using the VPN Wizard on both the 506e and the 501, I believe I have established an IPSec VPN tunnel.

Question #1
How can I test to see if the VPN tunnel is, in fact, up?

Question #2
Now that the VPN tunnel has been established, what's the next step in getting a workstation on one network, to access a server resource on the other?

 

[yizhar]

HI.

Question #1 - How can I test to see if the VPN tunnel is, in fact, up?
Try to ping private addresses via the VPN tunnel.

Question #2 - Now that the VPN tunnel has been established, what's the next step in getting a workstation on one network, to access a server resource on the other?
There are 2 additional issues to consider after the VPN is working (pingable in both directions):
1) bandwidth issues.
2) name resolution.
You can overcome those 2 issues using a terminal server at the main site.
There are other solutions of course.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Xanjiin]

Thanks for the feedback.

As of last week, I was able to establish the VPN Tunnel and establish communications between the remote site and headquarters.

I'll be adding 4 more sites in the near future.

One thing I've noticed is 3DES is pretty slow. Although, it may have to do with limited bandwidth at the remote site (128k up). I'll have to increase this with the cable provider and see if there is any improvement.

Anyone know of an alternative to IPSEC and 3DES, other than DES? Do PIX's support blowfish?

Thanks for your responses.

 

[yizhar]

HI.

Take a look here:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/ps2031/index.html

As you can see the pix 501 supports 3mbps 3DES and the pix 506 should support more. So the issue is probably the actual line bandwidth.

Check by trial and error (ping -f -l ...) what is the best MTU for the hosts. The VPN traffic and/or some xDSL connections encapsulate the traffic and fragment large packets, so a smaller MTU can speed up things by eliminating fragmentation.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[volk125]

try this...

global (outside) 1 xxx.xxx.xxx.xxx (an IP address for PAT translation, which means pick any one of the external addresses out your available range)
nat (inside) 1 10.0.0.0 255.0.0.0 0 0
conduit permit icmp any any

you should be able to ping no problem

also, your gateway on the workstation has to be the firewall's inside IP and and specify proper DNS servers too.