Traffic release of PIX & ASA

The old arm summarized the PIX traffic release problem: NAT, from high to low (Security Level) ACL, allow traffic ESP, isakmp (vpn protocol) on ports with a completely low level ), non-stateful protocol. status monitoring is not supported and the returned ESP traffic must be released. GRE is a protocol traffic that does not support status. You need to release the returned gre traffic.

The old arm summarized the PIX traffic release problem: NAT, from high to low (Security Level) ACL, allow traffic ESP, isakmp (vpn protocol) on ports with a completely low level ), non-stateful protocol. status monitoring is not supported and the returned ESP traffic must be released. GRE is a protocol traffic that does not support status. You need to release the returned gre traffic.

Old armSummary PIXTrafficAllowProblem:

NAT, from high to low (Security Level)
ACL, on a port with a completely lower levelAllowTraffic
ESP, isakmp (vpn protocol), non-stateful Protocol, does not support stateful monitoring, requiresAllowReturned ESPTraffic.
GRE is a stateless protocol.Traffic, RequiredAllowReturned greTraffic.

AllowICMPTraffic:
# Access-list out permit icmp any
# Access-group out in interface outside

When configuring the BGP protocol, if the BGP session is encrypted, the transparent firewall cannot be crossed by default. This is because the firewall enables the small feature of TCP serial number randomization by default for security reasons. In addition, the firewall will erase some TCP option bits. In the BGP encrypted session, the option 19 contains the MD5 encryption attribute information. After the firewall clears this field, the encrypted BGP session cannot be established. Solution:AllowOPTION 19,

AllowOption 19: // number 19 of the option field in the TCP Header
Class-map BGP-MD5-classmap
Match port TCP/IP eq 179
Tcp-map BGP-MD5
Tcp-option range 19 19 allow

Policy-map global_policy
Class BGP-MD5-classmap
Set connection advanced-option BGP-MD5

Service-policy global_policy global

View Original: http://www.laogebo.com/archives/246.html

Old arm BLOG