Tech-Recipes - Latest Comments in Cisco PIX: Allow traffic to an internal host | Cisco firewall | Tech-Recipes

Re: Cisco PIX: Allow traffic to an internal host | Cisco firewall | Tech-Recipes

Flibble — Tue, 07 Sep 2004 22:47:05 -0000

or rather ICMP doesn't JUST equal PING. Opening up all of the ICMP protocol allows source quenches, router redirection and a whole host of stuff that can cause problems. If all that is required is PING then restrict the traffic to echo request <->echo reply.

Re: Cisco PIX: Allow traffic to an internal host | Cisco firewall | Tech-Recipes

Anonymous — Wed, 09 Jun 2004 06:47:50 -0000

Sorry I should have posted this above. Cisco has a tool on their website to help in converting conduits to ACLs. It works pretty well but YMMV. <span style="text-decoration:underline">Always</span> check the configuration file afterward.

Online tool:
https://cco-dev.cisco.com/cgi-bin/Support/Outpu...

Downloadable tool if you have a CCO login:
http://www.cisco.com/cgi-bin/tablebuild.pl/pix

-Tom

Re: Cisco PIX: Allow traffic to an internal host | Cisco firewall | Tech-Recipes

Anonymous — Wed, 09 Jun 2004 06:40:49 -0000

FYI: ACL's were added in IOS 5.3. All major releases after 6.3 have dropped support for conduits and you must use ACLs.