Cisco PIX 525 Spécifications télécharger pdf (Page 62)

2-2

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Initial Configuration Checklist

Ta b l e 2-1 Initial Configuration Checklist

Task Explanation Procedure

If you have

purchased a new

feature license,

upgrade your

feature license

If you have purchased (or need to purchase) a new

activation key for your PIX

Firewall, upgrade your

license before configuring the firewall.

Refer to the “Upgrading Your License by

Entering a New Activation Key” section on

page 11-2 in Chapter 11, “Changing Feature

Licenses and System Software.”

Deny ICMP traffic

to the outside

interface

By default, the PIX Firewall denies all inbound traffic

through the outside interface. Before enabling inbound

connectivity through the outside interface, you should

consider configuring the PIX

Firewall to deny all ICMP

traffic to the outside interface.

If no ICMP control list is configured, then the

PIX

Firewall accepts all ICMP traffic that terminates at

any interface, including the outside interface.

To deny all ICMP traffic, including ping

requests, through the outside interface, enter

the following command:

icmp deny any outside

Enter this command for each additional

interface on which you want to deny ICMP

traffic.

Note To test connectivity through the

outside interface, temporarily change

this setting, as described in the

“Testing and Saving Your

Configuration” section on page 2-22.

For more information about the icmp

command, refer to the Cisco PIX

Firewall

Command Reference.

Prevent

fragmented

packets

By default, the PIX Firewall accepts up to 24 fragments

to reconstruct a full IP packet. Based on your network

security policy, you should consider configuring the

PIX

Firewall to prevent fragmented packets from

traversing the firewall.

The PIX Firewall FragGuard feature provides IP

fragmentation protection even without explicitly

denying fragmented packets.

To prevent fragmented packets on the outside

and inside interfaces enter the following

command:

fragment chain 1 outside

fragment chain 1 inside

Enter this command for each additional

interface on which you want to prevent

fragmented packets.

Note Adjust this setting to allow Network

File System (NFS) connectivity

through the interface.

Setting the limit to 1 means that all packets

must be unfragmented.

For more information about the fragment

command, refer to the Cisco PIX

Firewall

Command Reference.

Set default routes Configure the default routes on your routers and hosts

to forward traffic to the PIX

Firewall.

Refer to the “Setting Default Routes” section

on page 2-3.

1 2 ... 57 58 59 60 61 62 63 64 65 66 67 ... 465 466

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 62

Commentaires sur ces manuels

Produits connexes et manuels pour Systèmes de contrôle d'accès de sécurité Cisco PIX 525