C H A P T E R 7

Configuring Access

Managing controlled access to network resources from an untrusted (Internet) network is a very important function of the PIX Firewall. Access lists, static NATs, and authentication and authorization are ways to provide access through the PIX Firewall in a controlled fashion. In addition, PIX version 6.2 has new features such as object grouping and TurboACL. These new features make managing and implementing a complex security policy much easier and more scalable.

“Do I Know This Already?” Quiz

The purpose of this quiz is to help you determine your current understanding of topics covered in this chapter. Write down your answers and compare them to the answers in Appendix A. If you have to look at any references to correctly answer the questions about PIX functionality, you should read that portion and double-check your thinking by reviewing the Foundation Summary. The concepts in this chapter are the foundation of much of what you need to understand to pass the CSPFA Certification Exam. Unless you do exceptionally well on the “Do I Know This Already?” pretest and are 100% confident in your knowledge of this area, you should read through the entire chapter.

1What do static NAT settings do?

2True or false: Static NAT is the only configuration that lets inbound access in.

3Can the conduit command be used in place of the access-list command?

4About how many access list entries (ACEs) in one access list does TurboACL support?

5What is the minimum memory required to run TurboACL?

6What is the command to enable TurboACL globally on the PIX Firewall?

7What is the minimum number of access list entries needed for TurboACL to compile?

8What is the function of object groups?

9What is the command to enable a network object group?

10What are the four object type options when you’re creating object groups?

112 Chapter 7: Configuring Access

Foundation Topics

Configuring Inbound Access Through the PIX Firewall

A two-step approach lets connections initiated from lower-security interfaces access highersecurity interfaces:

Step 1 Static Network Address Translation

Step 2 Access lists/conduits

Static Network Address Translation

Static Network Address Translation (NAT) creates a permanent, one-to-one mapping between an address on an internal network (a higher security level interface) and an external network (a lower security level interface) in all PIX versions. For an external host to initiate traffic to an inside host, a static translation rule needs to exist for the inside host. This can also be done using a nat 0 access-list address translation rule. Without the persistent translation rule, the translation cannot occur.

attack by a flood of embryonic connections. The default is 0, which means unlimited connections.

The following example maps a server with an internal IP address of 10.1.1.10 to the IP address 192.168.10.10:

PIXFIREWALL(conf)#static (inside, outside) 192.168.100.10 10.1.100.10 netmask

255.255.255.255

The static command can also be used to translate an IP subnet:

PIXFIREWALL(conf)#static (inside, outside) 192.168.1.0 10.1.100.0 netmask

255.255.255.0

In this example, the Class A subnet of 10.1.100.0 255.255.255.0 is to be translated to the Class C network of 192.168.10.0. This sample configuration gives the same IP address to the host on the 10.1.100.0 255.255.255.0 to be translated on the 192.168.10.0 255.255.255.0 network. A host with an IP address of 10.1.100.10 is mapped to 192.168.1.10.

Static Port Address Translation

In PIX 6.0, the port redirection feature was added to allow outside users to connect to a particular IP address/port and have the PIX redirect the traffic to the appropriate inside server; the static command was modified. The shared address can be a unique address or a shared outbound Port Address Translation (PAT) address, or it can be shared with the external interface. For example, static PAT lets you redirect inbound TCP and UDP

114 Chapter 7: Configuring Access

services. Using the static command’s interface option, you can use static PAT to permit external hosts to access TCP or UDP services residing on an internal host. (As always, though, an access list should also be in place to control access to the internal host.) The command to configure static PAT is as follows:

static [(internal_if_name, external_if_name)] {tcp | udp}{global_ip | interface} global_port local_ip local_port [netmask mask][max_conns [emb_limit

[norandomseq]]]

Static PAT supports all applications that are supported by (regular) PAT, including the same application constraints. Like PAT, static PAT does not support H.323 or multimedia application traffic. The following example enables static port address translation (static PAT) for FTP service, interfaces, and hosts:

static (inside, outside) tcp 192.168.1.14 ftp 10.1.2.8 ftp

The next example shows the following:

•The PIX redirects external users’ Telnet requests to IP address 192.168.1.24 to 10.1.2.19.

•The PIX redirects external users’ HTTP port 8080 requests to PAT address 192.168.1.24 to 10.1.2.20 port 80.

static (inside,outside) tcp 192.168.1.24 telnet 10.1.2.19 telnet netmask 255.255.255.255

static (inside,outside) tcp 192.168.1.24. 8080 10.1.2.20 www netmask 255.255.255.255

access-list 101 permit tcp any host 192.168.1.24 eq 8080 access-list 101 permit tcp any host 172.18.124.99 eq telnet

Notice that the outside IP address 192.168.1.24 is the same for both mappings, but the internal IP address is different. Also notice that external users directed to 192.168.1.24:8080 are sent as HTTP requests to 10.1.2.20, which is listening on port 80.

TCP Intercept Feature

Before version 5.3, the Cisco PIX Firewall offered no mechanism to protect systems that could be reached via a static and TCP conduit from TCP SYN attacks. When the embryonic connection limit was configured in a static command statement, the earlier PIX version simply dropped new connection attempts as soon as the embryonic threshold was reached. A mild TCP SYN attack could potentially create service disruption to the server in question. For static command statements without an embryonic connection limit, PIX passes all traffic. If the affected system does not have TCP SYN attack protection (most operating systems do not offer sufficient protection), the affected system’s embryonic connection table overloads, and all traffic stops.

With the new TCP intercept feature, as soon as the optional embryonic connection limit is reached, and until the embryonic connection count falls below this threshold, every SYN bound for the affected server is intercepted. For each SYN, the PIX responds on behalf of