Thursday, October 16, 2008

Cisco pix firewall configuration notes

To start logging for debug:
logging buffered debugging

To view logs:
show logging

Log to remote syslog:
logging trap errors
logging host inside ip

Need a default route as a catchall on the outside interface:
route outside ip 1

ntp server source inside prefer

Disable nat in both directions:
nat (inside) 0
static (inside,outside) internalip internalip netmask

If you are dicking around with nat rules make sure you:
clear xlate
clear arp
show xlate

Use nat to do inside --> outside nat. Use static for outside --> inside. To use port address translation (PAT) for inside --> outside with the outside external ip:
nat (inside) 1 ip netmask
global (outside) 1 interface

Enable SSH login from a IP range on the internal side:
ssh ip netmask inside
ca generate rsa key 2048

To save config:
wr mem
ca save all

No comments: