PIX 515 - 4.4 to 6.3 upgrade 1

[nix45]

I'm about to upgrade the software on a PIX 515 from 4.4 to 6.3. I have a very basic set up. All I need is to allow hosts behind the PIX to be able to get out to the Internet, and I need for outside users to be able to access our web and mail server. Does this config look okay for the 6.3 software (only non-defaults shown)? Please let me know if I'm missing anything.


nameif ethernet0 inside security0
nameif ethernet1 inside security100

enable password cisco encrypted
passwd cisco
hostname PIX515

ip address outside 12.12.12.210 255.255.255.240
ip address inside 192.0.30.1 255.255.255.0

global (outside) 1 12.12.12.222
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

telnet 192.0.1.0 255.255.255.0 inside
telnet password cisco

static (inside,outside) 12.12.12.211 192.0.30.10
static (inside,outside) 12.12.12.212 192.0.30.20

conduit permit tcp host 12.12.12.211 eq 80 any
conduit permit tcp host 12.12.12.212 eq 25 any
conduit permit icmp any any

route outside 0 0 12.12.12.209
route inside 0 0 192.0.1.0 255.255.255.0 192.0.30.2


Thanks,
Chris

 

[baddos]

That config looks like it will port over fine.

When you upgrade to 6.3, you should change your conduit list to an access-list.

Change:
conduit permit tcp host 12.12.12.211 eq 80 any
conduit permit tcp host 12.12.12.212 eq 25 any
conduit permit icmp any any

To:
access-list 101 permit tcp any host 12.12.12.211 eq 80
access-list 101 permit tcp any host 12.12.12.212 eq 25
access-group 101 in interface outside

Access-lists run faster than conduits. Definatly worth the conversion.

 

[nix45]

Thanks. I read that conduit and access-lists do the same thing, but I wasn't sure if there was any difference between the two.

Chris

 

[nix45]

...what about the ICMP statement? Can I do something like this...

access-list 101 permit any any eq icmp

I want to allow pings to go through the PIX.


Thanks,
Chris

 

[nix45]

..or this..

access-list 101 permit icmp any host 12.12.12.209 echo

...where 12.12.12.209 is the outside interface of the PIX.

 

[baddos]

"access-list 101 permit icmp any host 12.12.12.209 echo"

That should work fine.

 

[havanajoe]

You'll need to allow for the echo-reply to come back through the PIX.

access-list in permit icmp any any echo-reply