Configuration Examples

PIX Firewall provides nameif and interface command statements for the interfaces in the default configuration.

Identify the IP addresses for both interfaces.

Specifies the host name for the PIX Firewall. This name appears in the command line prompt.

Sets the ARP timeout to 14,400 seconds (four hours). Entries are kept in the ARP table for four hours before they are flushed. Four hours is the standard default value for ARP timeouts.

Disables failover access.

Enables use of text strings instead of IP addresses. This makes your configuration files more readable.

Enables paging so that if when 24 lines of information display, PIX Firewall pauses the listing and prompts you to continue.

Enables syslog messages, which provide diagnostic information and status for the PIX Firewall. PIX Firewall makes it easy to view syslog messages with the show logging command.

Lets inside IP addresses be recognized on the outside network and lets inside users start outbound connections.

Sets RIP listening attributes. The first command causes the PIX Firewall to broadcast a default route on the inside interface. Broadcasting a default route sends network traffic to the PIX Firewall if your internal network is running RIP. The next command disables passive RIP listening on the inside. The next command disables broadcasting a default route on the outside. This is desirable when the network is attached to the Internet, but not when on an intranet. The last command disables passive RIP listening on the outside.

Sets the outside default route to the router attached to the Internet.

Default values for the maximum duration that PIX Firewall resources can remain idle until being freed. Additional users cannot make connections until a connection resource is freed either by a user dropping a connection or by an xlate and conn timer time out.

Specifies that SNMP information may be accessed by internal hosts that know the community string, but PIX Firewall does not send trap information to any host.

Sets the maximum transmission unit value for Ethernet access.

PIX Firewall provides nameif and interface command statements for the interfaces in the default configuration.

Identify the IP addresses for both interfaces.

Set the ARP timeout to 14,400 seconds (four hours). Entries are kept in the ARP table for four hours before they are flushed.

Permit all inside users to start outbound connections using the translated IP addresses from the global pool.

Create a pool of global addresses that translated addresses use when they exit the firewall from the protected networks to the unprotected networks. The global command statement is associated with a nat command statement by the NAT ID, which in this example is 1. Because there are limited IP addresses in the pool, a PAT (Port Address Translation) global is added to handle overflow.

PIX Firewall does use RIP information for its forwarding decisions, but these commands can be useful for broadcasting a default route—if your network uses the RIP protocol. However, most do not. In most cases, you can ignore these command statements.

Sets the outside default route to the router attached to the Internet.

Sets default values for the maximum duration that PIX Firewall resources can remain idle until being freed. Additional users cannot make connections until a connection resource is freed either by a user dropping a connection or by an xlate and conn timer time out.

Allows inbound and outbound pings.

Specifies that SNMP information may be accessed by internal hosts that know the community string, but PIX Firewall does not send trap information to any host.

Specifies that host 10.0.0.100 is permitted to access the PIX Firewall console via Telnet and that 15 minutes are allowed before the idle timer runs out and the session is logged off.

Sets the maximum transmission unit value for Ethernet access.

PIX Firewall provides nameif and interface command statements for the interfaces in the default configuration.

Identify the IP addresses for both interfaces.

The logging host command statement specifies which host runs a syslog server. This command also causes the PIX Firewall to start sending syslog messages to that host. The logging trap command statement sets syslog to send all possible messages to the syslog host. The no logging console command statement disables displaying messages to the console.

Set an ARP timeout to 600 seconds (10 minutes). Use this arp timeout command statement when you set up a network and change inside and outside host addresses often.

Permit all inside users to start outbound connections using the translated IP addresses from the global pool.

Create pools of global addresses to let the nat command statements use the address pools for translating internal IP addresses to external addresses. Each pool is designated by the number from the nat command statement, in this case, 1 and 2.

Allow inbound and outbound pings. Access list group "acl_in" is bound to the inside interface and group "acl_out" is bound to the outside interface.

Create outbound access lists to determine which hosts can access services. The first access-list command statement denies host 192.168.3.3 from accessing H.323 (port 1720) services such as MS NetMeeting or InternetPhone. The next command statement denies all hosts from accessing the Web (port 80). The next command statement permits host 192.168.3.3 to use the Web. The last access-list command statement permits host 10.1.1.11 access to the Web (at port 80).

Specify that the access-list group regulates the activities of inside hosts starting outbound connections.

Keep host 192.168.3.3 from downloading Java applets.

The first command disables RIP listening on the outside interface. The second command disables broadcasting a default route on the outside.

The third command enables RIP listening on the inside and the last command causes PIX Firewall to broadcast a default route on the inside interface.

Set the default route on the outside network to be 209.165.201.4. This is the IP address of the gateway host connecting to the Internet.

The aaa-server command specifies the IP address of the TACACS+ authentication server. The aaa authentication command statement specifies that users on network 192.168.3.0 starting FTP, HTTP, and Web connections from the inside interface be prompted for their usernames and passwords before being permitted to access these servers on other interfaces. The aaa authorization command statement lets the users on 192.168.3.0 access FTP, HTTP, or Telnet, and any TCP connections to anywhere as authorized by the AAA server. Even though it appears that the aaa commands let the PIX Firewall set security policy, the authentication server actually does the work to decide which users are authenticated and what services they can access when authentication is permitted.

The static command statement creates a net static command statement, which is a static command statement for a set of IP addresses, in this case for IP addresses 209.165.201.17 through 209.165.201.30.

The static command statement with the access-list command statement establishes an externally visible IP address for Web access (port 80 in the access-list command statement).

Refine the accessibility of the static command by permitting Sun RPC over the UDP portmapper on port 111 with the rpc literal. Refer to the UNIX /etc/rpc file and the UNIX rpc(3N) command page for more information. Once you create an access-list command statement for RPC, you can use the following command from outside host 209.165.201.2 to track down the activity of a PCNFSD on RPC 150001:

Permit NFS access, which occurs at port 2049 and provides access between the outside and inside, such that host 209.165.201.2 can mount 10.1.1.11 via the global address 209.165.201.11.

Identify access to the 10.1.1.3 mail server through global address 209.165.201.12. The access-list command statement any outside host access to the static via SMTP (port 25). By default, PIX Firewall restricts all access to mail servers to RFC 821 section 4.5.1 commands of DATA, HELO, MAIL, NOOP, QUIT, RCPT, and RSET. This occurs via the Mail Guard service which is set with the following default configuration command:

fixup protocol smtp 25

Another aspect of providing access to a mail server is setting being sure that you have a DNS MX record for the static's global address, which outside users access when sending mail to your site.

Create access to port 113, the IDENT protocol. If the mail server has to talk to many mail servers on the outside which connect back with the now obsolete and highly criticized IDENT protocol, use this access-list command statement to speed up mail transmission. The access-group command statement binds the access-list command statements to the outside interface.

These commands specify that host 192.168.3.2 can receive SNMP events, which the PIX Firewall sends via syslog. The location and contact commands identify where the host is and who administers it. The community command describes the password in use at the SNMP server for verifying network access with the server.

These commands permit host access to the PIX Firewall console. The first telnet command permits a single host, 10.1.1.11 to access the PIX Firewall console with Telnet. The 255 value in the last octet of the netmask means that only the specified host can access the console.

The second telnet command permits PIX Firewall console access from all hosts on the 192.168.3.0 network. The 0 value in the last octet of the netmask permits all hosts in that network access. However, Telnet only permits 16 hosts simultaneous access to the PIX Firewall console over Telnet.

PIX Firewall provides nameif and interface command statements for the interfaces in the default configuration.

Identify the IP addresses for each of the three interfaces.

Specifies the host name for the PIX Firewall. This name appears in the command line prompt.

Sets the ARP timeout to 14,400 seconds (four hours). Entries are kept in the ARP table for four hours before they are flushed. Four hours is the standard default value for ARP timeouts.

Disables failover access.

Lets you use text strings instead of IP addresses, which makes your configuration easier to read.

Enables paging so that if when 24 lines of information display, PIX Firewall pauses the listing and prompts you to continue.

Enable syslog messages, which provide diagnostic information and status for the PIX Firewall. You can view the messages with the show logging command and clear the message buffer with the clear logging command.

Sets RIP listening attributes. The first two command statements enable RIP listening on the inside, but disable it on the outside. The no rip interface default commands causes PIX Firewall to not broadcast a default route on either interface.

Sets the outside default route to the gateway attached to the Internet.

Default values for the maximum duration that PIX Firewall resources can remain idle until being freed.

Specifies that SNMP information may be accessed by internal hosts that know the community string, but PIX Firewall does not send trap information to any host.

Sets the maximum transmission unit value for Ethernet access.

Disables NAT (Network Address Translation).

Maps access to the 209.165.201.19 host on the dmz interface. The access-list command lets any outside user access the host on any port.

PIX Firewall provides nameif and interface command statements for the interfaces in the default configuration.

Identify the IP addresses for each of the three interfaces.

Specify the host name for the PIX Firewall. This name appears in the command line prompt.

Set the ARP timeout to 14,400 seconds (four hours). Entries are kept in the ARP table for four hours before they are flushed. Four hours is the standard default value for ARP timeouts.

Disable failover access.

Lets you use text strings instead of IP addresses, which makes your configuration easier to read.

Enable paging so that if after 24 lines of information display, PIX Firewall pauses the listing and prompts you to continue.

Enable syslog messages, which provide diagnostic information and status for the PIX Firewall. You can view the messages with the show logging command and clear the message buffer with the clear logging command.

Disable RIP attributes.

Set the outside default route to the router attached to the Internet.

Allow inbound and outbound pings. The "ping_acl" access-list command statement group is bound to the inside interface. The "acl_out" group is bound to the outside interface. This distinction accommodates the access-list command statement later in the configuration that applies permissions to a static command statement mapping. When troubleshooting is complete, remove the ICMP access-list statements.

Default values for the maximum duration that PIX Firewall resources can remain idle until being freed.

Specify that SNMP information may be accessed by internal hosts that know the community string, but PIX Firewall does not send trap information to any host.

Set the maximum transmission unit value for Ethernet access.

Give Telnet access to PIX Firewall console to inside host. Use the timeout feature to set the maximum time a Telnet session can be idle before PIX Firewall closes the connection to 15 minutes. The default is 5 minutes.

Create a pool of global addresses for the outside and DMZ interfaces. Because there are limited outside IP addresses, add a PAT global to handle overflow. The global (dmz) command gives inside users access to the web server on the DMZ interface.

Let inside users start connections on the DMZ and outside interfaces, and let DMZ users start connections on the outside interface.

Give the IP address of the web server a label.

Let any user on the outside interface access the web server on the DMZ interface. The access-list command statement is bound to the outside interface by the access-group command statement.

PIX Firewall provides nameif and interface command statements for the interfaces in the default configuration.

Identify the IP address for each interface.

Specify the host name for the PIX Firewall. This name appears in the command line prompt.

Set the ARP timeout to 14,400 seconds (four hours). This command statement is provided in the default configuration.

Disable failover access.

Lets you use text strings instead of IP addresses, which makes your configuration easier to read.

Enable paging so that if after 24 lines of information display, PIX Firewall pauses the listing and prompts you to continue.

Enable syslog messages, which provide diagnostic information and status for the PIX Firewall. You can view the messages with the show logging command and clear the message buffer with the clear logging command.

Disable RIP attributes.

Set the outside default route to the router attached to the Internet.

Allow inbound and outbound pings. When you are done ping testing, remove these lines. Permitting anyone to ping through the PIX Firewall adds extra overhead to the PIX Firewall and permits attackers to probe network vulnerabilities. The access-group commands for the "acl_out," "acl_dmz1," and "acl_dmz2" access-list command statement groups appear later in the configuration.

Default values for the maximum duration that PIX Firewall resources can remain idle until being freed.

Specify that SNMP information may be accessed by internal hosts that know the community string, but PIX Firewall does not send trap information to any host.

Set the maximum transmission unit value for Ethernet access. You need to add the MTU command statements for the dmz1 and dmz2 interfaces.

Give Telnet access to PIX Firewall console to inside host. Use the timeout feature to let Telnet console sessions stay idle up to 15 minutes before PIX Firewall closes the connection. The default is 5 minutes.

Let inside users start connections on all lower security level interfaces: dmz1, dmz2, and the outside.

Let dmz2 users start connections on all lower security level interfaces: dmz1 and the outside.

Let dmz1 users start connections on all lower security level interfaces, which in this case, is the outside.

Give access to the dmz2 interface for users on the inside interface. This global command statement lets inside users access the dmz2 web server and provides access to the 10.2.2.0 and 10.2.3.0 networks.

Give access to the dmz1 interface for users on the inside and dmz2 interfaces. This global command statement lets inside and dmz2 users access the dmz1 mail server and provides access to the 10.1.2.0 and 10.1.3.0 networks.

Create a pool of global addresses for the outside interface to permit users on all other interfaces to access the Internet. Because there are potentially more than 244 users on the 3 other interfaces, add a PAT global to handle overflow.

Let outside users access the 10.1.1.2 mail server on the dmz1 interface. The outside users access the mail server via global address 209.165.201.5 on the outside interface. The access-list command statement lets users access the mail server on port 25 (smtp).

The access-group command binds the "acl_out" access-list command statement group to the outside interface. The access-group command also applies to the other "acl_out" group access-list command statements that follow.

Let outside users access the 10.2.1.2 web server on the dmz2 interface. The outside users access the web server via global address 209.165.201.6 on the outside interface. The access-list command statement lets users access the web server on port 80 (www).

Let outside users access the 10.0.1.2 Telnet server on the inside interface. The outside users access the Telnet server via global address 209.165.201.7 on the outside interface. The access-list command statement lets users access the Telnet server on port 23 (telnet).

Let dmz1 users access the 10.2.1.2 web server on the dmz2 interface. The dmz1 users access the web server via global address 10.1.1.6 on the dmz1 interface. The access-list command statement lets users access the web server on the WWW port (80).

The access-group command binds the "acl_dmz1" access-list command statement group to the dmz1 interface. The access-group command also applies to the other "acl_dmz1" group access-list command statements that follow.

Let dmz1 users access the 10.0.1.2 Telnet server on the inside interface. The dmz1 users access the Telnet server via global address 10.1.1.7 on the dmz1 interface. The access-list command statement lets users access the Telnet server on port 23 (telnet).

Let dmz2 users access the 10.0.1.2 Telnet server on the inside interface. The dmz2 users access the Telnet server via global address 10.2.1.7 on the dmz2 interface. The access-list command statement lets users access the Telnet server on port 23 (telnet). The access-group command binds the "acl_dmz2" access-list command statement group to the dmz2 interface.

Provide static routes so that packets destined for the 10.1.2.0 and 10.1.3.0 networks are sent to the 10.1.1.3 router on the dmz1 interface.

Provide static routes so that packets destined for the 10.2.2.0 and 10.2.3.0 networks are sent to the 10.2.1.3 router on the dmz2 interface.

Provide static routes so that packets destined for the 10.0.2.0 and 10.0.3.0 networks are sent to the 10.0.1.3 router on the inside interface.

PIX Firewall provides nameif command statements for all interfaces. In this case, the default perimeter names were changed to dmz1 through dmz4.

PIX Firewall provides interface command statements for all six interfaces in the default configuration

Identify the IP address for each interface.

Specify the host name for the PIX Firewall. This name appears in the command line prompt.

Set the ARP timeout to 14,400 seconds (four hours). This command statement is provided in the default configuration.

Disable failover access.

Lets you use text strings instead of IP addresses, which makes your configuration easier to read.

Enable paging so that if after 24 lines of information displays, PIX Firewall pauses the listing and prompts you to continue.

Enable syslog messages, which provide diagnostic information and status for the PIX Firewall. You can view the messages with the show logging command and clear the message buffer with the clear logging command.

Disable RIP attributes. Add command statements for the perimeter interfaces.

Set the outside default route to the router attached to the Internet.

Provide static routes so that packets destined for the 10.1.2.0 and 10.1.3.0 networks are sent to the 10.1.1.4 router on the dmz1 interface.

Provide static routes so that packets destined for the 10.4.2.0 and 10.4.3.0 networks are sent to the 10.4.1.4 router on the dmz4 interface.

Provide static routes so that packets destined for the 10.1.2.0 and 10.0.3.0 networks are sent to the 10.0.1.4 router on the inside interface.

Allow inbound and outbound pings. When you are done ping testing, remove these command statements to prevent extra overhead and vulnerability from probing. The access-group command statements for the "acl_out" and "acl_dmz1" command groups appear later in the configuration.

Default values for the maximum duration that PIX Firewall resources can remain idle until being freed.

Specify that SNMP information may be accessed by internal hosts that know the community string, but PIX Firewall does not send trap information to any host.

Set the maximum transmission unit value for Ethernet access. You need to add the MTU command statements for the perimeter interfaces.

Give Telnet access to PIX Firewall console to users on the Telnet server on dmz2 host. PIX Firewall checks the interface IP address to ensure it is an internal interface. This lets users outside the network Telnet to the server and then access the PIX Firewall console from the server. This is one method that can be used to troubleshoot or administer a PIX Firewall from a remote location. Use the timeout command feature to let Telnet console sessions stay idle up to 15 minutes before PIX Firewall closes the connection. The default is 5 minutes.

Let inside users start connections on all lower security level interfaces: dmz1, dmz2, dmz3, dmz4, and the outside.

Let dmz1 users start connections on the lower security level interface: the outside.

Let dmz2 users start connections on all lower security level interfaces: dmz1 and the outside.

Let dmz3 users start connections on all lower security level interfaces: dmz1, dmz2, and the outside.

Let dmz4 users start connections on all lower security level interfaces: dmz1, dmz2, dmz3, and the outside.

Create a pool of global addresses for the outside interface to permit users on all other interfaces to access the Internet. Because there are a limited number of addresses in the global pool, add a PAT global to handle overflow.

Give access to the dmz1 interface for users on the dmz2, dmz3, dmz4, and the inside interfaces. This global command statement lets users on access these interfaces access the dmz1 mail server and provides access to the 10.1.2.0 and 10.1.3.0 networks.

Give access to the dmz2 interface for users on the inside interface. This global command statement lets inside users on the dmz3, dmz4, and inside access to the Telnet server of dmz2.

Give access to the dmz3 interface for users on the inside and dmz4 interfaces.

Give access to the dmz4 interface for users on the inside interface which also permits access to the 10.4.2.0 and 10.4.3.0 networks connected to the 10.4.1.4 router.

Give outside users access to the mailserver on the dmz1 interface.

Give outside users access to the Telnet server on the dmz2 interface.

Give dmz1 users access to the Telnet server on the dmz2 interface.

These statements identify the four interfaces. The "failover" interface is connected to the other PIX Firewall unit for use by Stateful Failover to convey messages between the units.

These default configuration command statements are for the following:

• Specify passwords and hostname
  
  
• Specify default ports that the PIX Firewall listens for services
  
  
• Let you specify names instead of IP addresses
  
  
• Limit output that displays to 20 lines before you are prompted to continue the display
  
  

The logging console errors command statement enables syslog message display at the console so that error, critical, and alert syslog messages are displayed. The logging facility 20 and logging queue 512 set the default values for the syslog message facility and message queue size.

The interface command statements set the outside and inside Ethernet interfaces for auto sensing. The first perimeter interface is set for 100baseTx, full-duplex, and the second perimeter interface is also set to auto sense.

The mtu command statements set the maximum transmission unit value to 1500 bytes, the default Ethernet setting.

The ip address command statements establish the IP addresses for each PIX Firewall interface. The outside interface is a NIC-registered address, whereas all other interfaces use the 192.168.n.n RFC 1918 Class C address.

The failover command statements enable failover and specify the IP addresses of each interface on the Standby unit. If you are using Stateful Failover, the failover link command specifies the name of the Stateful Failover interface, in this case, the "failover" interface.

Specify that ARP refresh its table every 4 hours.

Specify a PAT global for translating connections from the inside interface to the outside interface. Let all hosts on the inside start connections to the outside interface.

Identify a global static address on the outside interface for a web server on the inside interface. The access-list command statements permit any host on the outside to access the inside web server on port 80, and to permit Pings on all interfaces.

These rip command statements disable RIP listening on all interfaces.

Identify the outside router as the default router for the PIX Firewall.

The timeout commands specify the maximum durations that PIX Firewall resources can remain idle until being freed. These values are the default intervals.

These command statements are part of the default configuration that perform the following purposes:

• Define aaa-server names
  
  
• Disable SNMP
  
  
• Define how long a Telnet session to the PIX Firewall console can be idle before being timed out
  
  
• The width of the PIX Firewall console displays
  
  

PIX Firewall provides nameif and interface command statements for the interfaces in the default configuration.

Identify the IP addresses for both interfaces.

Default values for the privileged mode password and host name.

Default values that assign a port value for each service that the PIX Firewall provides special handling for.

Default settings to disable failover.

Default settings that lets you use text strings instead of IP addresses, which makes your configuration easier to read, and sets the screen output so 24 lines display at a time before you are prompted to continue.

Enable syslog output to the console to receive debugging messages.

Default Ethernet MTU settings.

Default value for the ARP timeout set to 14,400 seconds (four hours). Entries are kept in the ARP table for four hours before they are flushed.

Permit all inside users to start outbound connections using the translated IP addresses from the global pool.

Create a pool of global addresses that translated addresses use when they exit the firewall from the protected networks to the unprotected networks. The global command statement is associated with a nat command statement by the nat_ID, which in this example is 1.

Create an inbound access address on the outside of the intranet on the 192.168.128.0 network so that the 10.1.1.3 server on PIX Firewall 1 is accessible from that network.

Default settings to disable RIP listening and broadcasting.

Establish a default route on the outside interface so that packets are routed to the router on the outside interface.

Default timeout settings.

Default settings that disable SNMP access.

Set the TCP maximum segment size to 1380 bytes. This is recommended for data over the encrypted VPN channel. This value is set by default but does not display in the default configuration. It does not need to be specified in a configuration.

Enable IPSec traffic to bypass the check of conduit or access-group command statements. If you disable this option, you need to add a conduit command statement to your configuration to allow the required set of IPSec traffic.

Create a crypto map called "mymap" and specify with the ipsec-manual option that IKE will not be used to establish the IPSec security association.

Establish the transform set as myset, enable MD5 AH, and enable ESP with 56-bit DES encryption. Then associate the transform set with the crypto map entry.

The transform set is used in the IPSec security association negotiation to protect the data flows specified by that crypto map entry's access list. Because IKE is not used to establish security associations, a single transform set must be used. The transform set is not negotiated.

Permit IP traffic and permit IP access from some external host on another network.

Associate the map entry with the access list.

Establish PIX Firewall 2 as the peer. When IKE is not used, as in this example, only one peer is specified.

Establish the inbound AH session key. The SPI (security parameter index) is set to 400 and the string of characters after the SPI is the session key specified in hexadecimal.

Establish the outbound AH session key. The SPI is set to 300 and the string of characters after the SPI is the session key specified in hexadecimal.

Establish the inbound ESP session key. The SPI is set to 400. The cipher option indicates that the key string that follows the option is to be used with the ESP encryption transform.

Establish the outbound ESP session key. The SPI is set to 300 and the cipher and authenticator keys are set to the same values as the inbound command statement.

Default values for the duration in minutes that a Telnet console session can be idle before being logged off, and for the number of characters wide that display during the console session.

Apply the crypto map set to the interface through which IPSec traffic will flow.

PIX Firewall provides nameif and interface command statements for the interfaces in the default configuration.

Identify the IP addresses for both interfaces.

Default values for the privileged mode password and host name.

Default values that assign a port value for each service that the PIX Firewall provides special handling for.

Default settings to disable failover.

Default settings that lets you use text strings instead of IP addresses, which makes your configuration easier to read, and sets the screen output so 24 lines display at a time before you are prompted to continue.

Enable syslog output to the console to receive debugging messages.

Default Ethernet MTU settings.

Default value for the ARP timeout set to 14,400 seconds (four hours). Entries are kept in the ARP table for four hours before they are flushed.

Permit all inside users to start outbound connections using the translated IP addresses from the global pool.

Create a static mapping between the inside host and an external address beyond the outside router.

Permit access to the static mapping from the 192.168.128.0 network outside the router.

Create the default route to the outside router, and a static route to send packets on the inside interface.

Default timeout settings.

Default settings that disable SNMP access.

Default settings to disable RIP listening and broadcasting.

Create a crypto map called "mymap" and specify with the ipsec-manual option that IKE will not be used to establish the IPSec security association.

Establish the transform set as myset, enable MD5 AH, and enable ESP with 56-bit DES encryption. Then associate the transform set with the crypto map entry.

The transform set is used in the IPSec security association negotiation to protect the data flows specified by that crypto map entry's access list. Because IKE is not used to establish security associations, a single transform set must be used. The transform set is not negotiated.

Set the TCP maximum segment size to 1380 bytes. This is recommended for data over the encrypted VPN channel. This value is set by default but does not display in the default configuration.

Associate the map entry with the access list.

Establish PIX Firewall 1 as the peer. When IKE is not used, as in this example, only one peer is specified.

Establish the inbound AH session key. The SPI (security parameter index) is set to 300 and the string of characters after the SPI is the session key specified in hexadecimal. The SPI for PIX Firewall 2 is opposite of the values specified for PIX Firewall 1 (PIX Firewall 1 has an inbound SPI of 400 and an outbound SPI of 300).

Establish the outbound AH session key. The SPI is set to 400 and the string of characters after the SPI is the session key specified in hexadecimal.

Establish the inbound ESP session key. The SPI is set to 300. The cipher option indicates that the key string that follows the option is to be used with the ESP encryption transform.

Establish the outbound ESP session key. The SPI is set to 400 and the cipher and authenticator keys are set to the same values as the inbound command statement.

Default values for the duration in minutes that a Telnet console session can be idle before being logged off, and for the number of characters wide that display during the console session.

PIX Firewall provides nameif and interface command statements for the interfaces in the default configuration.

Default values for the privileged mode password and the Telnet password.

Define a host name for the PIX Firewall.

Set the domain name.

Default fixup protocol values that define port usage.

Default values that let you use names instead of an IP addresses, display 24 lines of text before you are prompted to continue, and disable syslog output.

Set the maximum transmission unit values for the Ethernet interfaces.

The IP addresses for each PIX Firewall interface.

Default values to disable failover.

Default value specifying that the ARP cache be reinitialized every four hours.

Disable NAT for the inside interface.

The nat 0 access-list command statement lets you to exempt traffic that is matched by the access-list command statement from the NAT services. Adaptive Security remains in effect with the nat 0 access-list command.

The access-list command statement permits IP traffic on all hosts on the inside network to be accessed by the hosts on PIX Firewall 2.

Default values to disable RIP listening or broadcasting. However, the inside interface does listen for RIP broadcasts.

Specify the router on the outside interface for default routes.

Default timer values.

Default values that permit access to the TACACS+ or RADIUS protocols; however, AAA is not used in this configuration.

Default values to disable SNMP access.

Define the crypto map transforms, specify ISAKMP access, match the map to the access list (both use ID 90 to be associated), set the tunnel peer to be the outside interface IP address of PIX Firewall 2 (209.165.200.229), and apply the crypto map to the outside interface.

Configure the ISAKMP policy.

Specify that IPSec traffic be implicitly trusted (permitted).

Default values for how long a Telnet console session can be idle and that a console session should display up to 80 characters wide on the console computer.

PIX Firewall provides nameif command statements for interfaces in the default configuration. In addition, the default configuration provides default names for the perimeter interfaces, but in this case, the configuration requires different names and security levels for the perimeter interfaces.

Default values for the privileged mode password and the Telnet password.

Define a host name for the PIX Firewall.

Set the domain name.

Default fixup protocol values that define port usage.

Default values that let you use names instead of an IP addresses, display 24 lines of text before you are prompted to continue, and disable syslog output.

Default interface definitions indicating that each Ethernet interface has automatic sensing capabilities to determine line speed and duplex.

Set the maximum transmission unit values for the Ethernet interfaces.

The IP addresses for each PIX Firewall interface.

Default values to disable failover.

Default value specifying that the ARP cache be reinitialized every four hours.

The nat 0 access-list command statement lets you to exempt traffic that is matched by the access-list command statement from the NAT services. Adaptive Security remains in effect with the nat 0 access-list command.

The access-list command statement permits IP traffic on all hosts on the inside network to be accessed by the hosts on PIX Firewall 1.

Default values to disable RIP listening or broadcasting.

Specify the router on the outside interface for default routes.

Default timer values.

Default values that permit access to the TACACS+ or RADIUS protocols; however, AAA is not used in this configuration.

Default values to disable SNMP access.

Define the crypto map transforms, specify ISAKMP access, match the map to the access list (both use ID 80 to be associated), set the tunnel peer to be the outside interface IP address of PIX Firewall 1 (209.165.201.8), and apply the crypto map to the outside interface.

Configure the ISAKMP policy.

Specify that IPSec traffic be implicitly trusted (permitted).

Default values for how long a Telnet console session can be idle and that a console session should display up to 80 characters wide on the console computer.

PIX Firewall provides nameif command statements for the interfaces in the configuration.

Default values for the privileged mode password and the Telnet password.

Define a host name for the PIX Firewall.

Set the domain name.

Default fixup protocol values that define port usage.

Default values that let you use names instead of an IP addresses, display 24 lines of text before you are prompted to continue, and disable syslog output.

Default interface definitions indicating that each Ethernet interface has automatic sensing capabilities to determine line speed and duplex.

Set the maximum transmission unit values for the Ethernet interfaces.

The IP addresses for each PIX Firewall interface.

Default values to disable failover.

Default value specifying that the ARP cache be reinitialized every four hours.

Disable NAT for the inside interface.

The nat 0 access-list command statement lets you to exempt traffic that is matched by the access-list command statement from the NAT services. Adaptive Security remains in effect with the nat 0 access-list command.

The access-list command statement permits IP traffic on all hosts on the inside network to be accessed by the hosts on PIX Firewall 2.

Default values to disable RIP listening or broadcasting. However, the inside interface does listen for RIP broadcasts.

Specify the router on the outside interface for default routes.

Default timer values.

Default values that permit access to the TACACS+ or RADIUS protocols; however, AAA is not used in this configuration.

Default values to disable SNMP access.

Define the crypto map transforms, specify ISAKMP access, match the map to the access list (both use ID 90 to be associated), set the tunnel peer to be the outside interface IP address of PIX Firewall 2 (209.165.200.229), and apply the crypto map to the outside interface.

Configure the ISAKMP policy.

Define VeriSign-related enrollment commands.

Specify that IPSec traffic be implicitly trusted (permitted).

Default values for how long a Telnet console session can be idle and that a console session should display up to 80 characters wide on the console computer.

PIX Firewall provides nameif command statements interfaces in the default configuration, but in this case, the configuration required different names and security levels for the perimeter interfaces.

Default values for the privileged mode password and the Telnet password.

Define a host name for the PIX Firewall.

Set the domain name.

Default fixup protocol values that define port usage.

Default values that let you use names instead of an IP addresses, display 24 lines of text before you are prompted to continue, and disable syslog output.

Default interface definitions indicating that each Ethernet interface has automatic sensing capabilities to determine line speed and duplex.

Set the maximum transmission unit values for the Ethernet interfaces.

The IP addresses for each PIX Firewall interface.

Default values to disable failover.

Default value specifying that the ARP cache be reinitialized every four hours.

Disable NAT for the inside interface.

The nat 0 access-list command statement lets you to exempt traffic that is matched by the access-list command statement from the NAT services. Adaptive Security remains in effect with the nat 0 access-list command.

The access-list command statement permits IP traffic on all hosts on the inside network to be accessed by the hosts on PIX Firewall 1.

Default values to disable RIP listening or broadcasting.

Specify the router on the outside interface for default routes.

Default timer values.

Default values that permit access to the TACACS+ or RADIUS protocols; however, AAA is not used in this configuration.

Default values to disable SNMP access.

Define the crypto map transforms, specify ISAKMP access, match the map to the access list (both use ID 80 to be associated), set the tunnel peer to be the outside interface IP address of PIX Firewall 1 (209.165.201.8), and apply the crypto map to the outside interface.

Configure the ISAKMP policy.

Define VeriSign-related enrollment commands.

Specify that IPSec traffic be implicitly trusted (permitted).

Default values for how long a Telnet console session can be idle and that a console session should display up to 80 characters wide on the console computer.

PIX Firewall provides nameif command statements for the inside and outside interfaces in the default configuration.

Default values for the privileged mode password and the Telnet password.

Define a host name for the PIX Firewall.

Set the domain name.

Default fixup protocol values that define port usage.

Default values that let you use names instead of an IP addresses, display 24 lines of text before you are prompted to continue, and disable syslog output.

Default interface definitions indicating that each Ethernet interface has automatic sensing capabilities to determine line speed and duplex.

Set the maximum transmission unit values for the Ethernet interfaces.

The IP addresses for each PIX Firewall interface.

Default values to disable failover.

Default value specifying that the ARP cache be reinitialized every four hours.

The nat 0 access-list command statement lets you to exempt traffic that is matched by the access-list command statement from the NAT services. Adaptive Security remains in effect with the nat 0 access-list command.

The access-list command statement permits IP traffic on all hosts on the inside network to be accessed by the hosts on PIX Firewall 2.

Default values to disable RIP listening or broadcasting. However, the inside interface does listen for RIP broadcasts.

Specify a static route to access the inside network of PIX Firewall 2.

Specify the router on the outside interface for default routes.

Default timer values.

Default values that permit access to the TACACS+ or RADIUS protocols; however, AAA is not used in this configuration.

Default values to disable SNMP access.

Define the crypto map transforms, specify ISAKMP access, match the map to the access list (both use ID 90 to be associated), set the tunnel peer to be the outside interface IP address of PIX Firewall 2 (209.165.200.229), and apply the crypto map to the outside interface.

Configure the ISAKMP policy.

Define Entrust-related enrollment commands.

Specify that IPSec traffic be implicitly trusted (permitted).

Default values for how long a Telnet console session can be idle and that a console session should display up to 80 characters wide on the console computer.

PIX Firewall provides nameif command statements for the inside and outside interfaces in the default configuration. In addition, the default configuration provides default names for the perimeter interfaces, but in this case, the configuration required different names and security levels for the perimeter interfaces.

Default values for the privileged mode password and the Telnet password.

Define a host name for the PIX Firewall.

Set the domain name.

Default fixup protocol values that define port usage.

Default values that let you use names instead of an IP addresses, display 24 lines of text before you are prompted to continue, and disable syslog output.

Default interface definitions indicating that each Ethernet interface has automatic sensing capabilities to determine line speed and duplex.

Set the maximum transmission unit values for the Ethernet interfaces.

The IP addresses for each PIX Firewall interface.

Default values to disable failover.

Default value specifying that the ARP cache be reinitialized every four hours.

The nat 0 access-list command statement lets you to exempt traffic that is matched by the access-list command statement from the NAT services. Adaptive Security remains in effect with the nat 0 access-list command.

The access-list command statement permits IP traffic on all hosts on the inside network to be accessed by the hosts on PIX Firewall 1.

Default values to disable RIP listening or broadcasting.

Specify the router on the outside interface for default routes.

Default timer values.

Default values that permit access to the TACACS+ or RADIUS protocols; however, AAA is not used in this configuration.

Default values to disable SNMP access.

Define the crypto map transforms, specify ISAKMP access, match the map to the access list (both use ID 80 to be associated), set the tunnel peer to be the outside interface IP address of PIX Firewall 1 (209.165.201.8), and apply the crypto map to the outside interface.

Configure the ISAKMP policy.

Define Entrust-related enrollment commands.

Specify that IPSec traffic be implicitly trusted (permitted).

Default values for how long a Telnet console session can be idle and that a console session should display up to 80 characters wide on the console computer.

PIX Firewall provides nameif command statements for the inside and outside interfaces in the default configuration. This example shows the default name for the perimeter interface "dmz."

Default values for the privileged mode password and the Telnet password.

Define a host name for the PIX Firewall.

Set the domain name.

Default fixup protocol values that define port usage.

Default values that let you use names instead of an IP addresses, display 24 lines of text before you are prompted to continue, and disable syslog output.

Default interface definitions indicating that each Ethernet interface has automatic sensing capabilities to determine line speed and duplex.

Set the maximum transmission unit values for the Ethernet interfaces.

The IP addresses for each PIX Firewall interface.

Default values to disable failover.

Default value specifying that the ARP cache be reinitialized every four hours.

Let users on the inside interface start connections on an interface with a lower security level.

Establish a pool of global addresses on the outside interface for translated addresses to use when users on the inside start connections to the outside.

Set the default route to be the router on the outside.

Default timeout values.

Create a pool of IP addresses that remote users access after they are authenticated by the AAA server.

Establish the AAA parameters. The first two command statements enable access to the TACACS+ and RADIUS protocols. The next command statement associates the partnerauth protocol to TACACS+.

Default values to disable SNMP.

Specify the IKE mode configuration parameters.

Establish association to local pool of IP addresses.

Create a transform set for Triple DES, ESP, SHA, and HMAC.

Create a dynamic crypto map that associates the access list and the transform set.

Define a crypto map that enables the ISAKMP policy.

Enable the Extended Authentication feature. Be sure to specify the same AAA server name within the crypto map client authentication command statement as was specified in the aaa-server command statement.

Apply the crypto map to the outside interface.

Create a wildcard, pre-shared key.

Create the ISAMP policy on the outside interface, to handle pre-shared keys, to have Triple DES encryption, and to provide an MD5 hash for additional security.

Implicitly permit IPSec connections through the PIX Firewall.

Default values for how long a Telnet console session can be idle and that a console session should display up to 80 characters wide on the console computer.