?
Solved

Cisco PIX TCP Connection Prevention Help with the static command

Posted on 2006-05-09
2
Medium Priority
?
537 Views
Last Modified: 2013-11-16
 
    Ok i am trying to implament this on our firewall's  they are pix 515 e
 software versoion 6.3
 
Here is the link to the cisco site...
 http://www.cisco.com/warp/public/707/cisco-response-20051122-pix.shtml

and it says to use the static command and set the  emb_limit to 1

 this is from Cisco's site

" For discarded TCP connections originating from lower security level interfaces to higher security level interfaces, TCP Intercept can be configured on STATIC commands by setting the emb_limit to 1. This results in the PIX proxying all connection attempts after the first connection. The PIX will create and send the TCP SYN,ACK from the destination to the original source. Since the original TCP SYN packet was spoofed, the source IP address will not be tracking the TCP connection and it will send a TCP RST to the PIX. The PIX will then close the connection originating from the TCP SYN packet with the incorrect checksum. TCP Intercept may impact firewall performance and should be tested before being enabled in a production environment. "

When i enter the command i get


 
  [no] static [(internal_if_name, external_if_name)]
         {<global_ip>|interface} <local_ip> [dns] [netmask <mask>]
         [<max_conns> [<emb_limit> [<norandomseq>]]]
 [no] static [(internal_if_name, external_if_name)] {tcp|udp}
         {<global_ip>|interface} <global_port>
         <local_ip> <local_port> [dns] [netmask <mask>]
         [<max_conns> [<emb_limit> [<norandomseq>]]]

invalid number of interfaces specified
  or
invalid syntax

  Please some one give me the correct way to put this command in ....

  Thanks experts in advance.....
 
 

0
Comment
Question by:vtobusman
2 Comments
 
LVL 9

Accepted Solution

by:
stressedout2004 earned 500 total points
ID: 16640674
If you have an existing static command, you need to first removed it because the PIX won't allow you to overwrite it.

e.g.
static (inside,outside) 1.1.1.1 10.10.10.1 netmask 255.255.255.255 0 0

To change the embryonic connection from unlimited to 1 of the following static statement, the following
commands needs to be run on  PIX under configuration mode.

no static (inside,outside) 1.1.1.1 10.10.10.1 netmask 255.255.255.255 0 0
static (inside,outside) 1.1.1.1 10.10.10.1 netmask 255.255.255.255 0 1


0
 
LVL 5

Author Comment

by:vtobusman
ID: 16641277
Thanks a bunch i know it was something simple
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Suggested Courses

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question