rendered paste bodysh tech
Cisco PIX Firewall Version 6.3(5)
Cisco PIX Device Manager Version 1.1(2)
Compiled on Thu 04-Aug-05 21:40 by morlee
fw01.hq up 4 days 1 hour
Hardware: PIX-515, 32 MB RAM, CPU Pentium 200 MHz
Flash i28F640J5 @ 0x300, 16MB
BIOS Flash AT29C257 @ 0xfffd8000, 32KB
0: ethernet0: address is 0003.6bf6.d059, irq 11
1: ethernet1: address is 0003.6bf6.d05a, irq 10
Licensed Features:
Failover: Enabled
VPN-DES: Enabled
VPN-3DES-AES: Enabled
Maximum Physical Interfaces: 6
Maximum Interfaces: 10
Cut-through Proxy: Enabled
Guards: Enabled
URL-filtering: Enabled
Inside Hosts: Unlimited
Throughput: Unlimited
IKE peers: Unlimited
This PIX has an Unrestricted (UR) license.
Serial Number: 405411551 (0x182a16df)
Running Activation Key: 0xc67542dc 0x23d2d180 0x394ee79a 0x754e71ad
Configuration last modified by enable_15 at 11:48:29.454 EDT Tue Oct 30 2007
------------------ show clock ------------------
10:17:43.272 EDT Wed Oct 31 2007
------------------ show memory ------------------
Free memory: 14938496 bytes
Used memory: 18615936 bytes
------------- ----------------
Total memory: 33554432 bytes
------------------ show conn count ------------------
1389 in use, 1554 most used
------------------ show xlate count ------------------
539 in use, 1033 most used
------------------ show blocks ------------------
SIZE MAX LOW CNT
4 1600 1593 1600
80 400 397 400
256 1524 1012 1524
1550 997 354 736
2560 200 150 198
------------------ show interface ------------------
interface ethernet0 "outside" is up, line protocol is up
Hardware is i82559 ethernet, address is 0003.6bf6.d059
IP address 216.223.62.17, subnet mask 255.255.255.224
MTU 1500 bytes, BW 100000 Kbit full duplex
21287462 packets input, 943768562 bytes, 0 no buffer
Received 226913 broadcasts, 0 runts, 0 giants
49 input errors, 0 CRC, 0 frame, 49 overrun, 0 ignored, 0 abort
21929947 packets output, 3991782921 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
input queue (curr/max blocks): hardware (128/128) software (0/129)
output queue (curr/max blocks): hardware (0/128) software (0/1)
interface ethernet1 "inside" is up, line protocol is up
Hardware is i82559 ethernet, address is 0003.6bf6.d05a
IP address 10.9.8.1, subnet mask 255.255.0.0
MTU 1500 bytes, BW 100000 Kbit full duplex
29631300 packets input, 4274818456 bytes, 0 no buffer
Received 7047694 broadcasts, 0 runts, 0 giants
59 input errors, 0 CRC, 0 frame, 59 overrun, 0 ignored, 0 abort
27459152 packets output, 2037684220 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
input queue (curr/max blocks): hardware (128/128) software (0/146)
output queue (curr/max blocks): hardware (0/128) software (0/436)
------------------ show cpu usage ------------------
CPU utilization for 5 seconds = 8%; 1 minute: 7%; 5 minutes: 7%
------------------ show process ------------------
PC SP STATE Runtime SBASE Stack Process
Hsi 001f02c9 008f806c 0056ed50 20 008f70e4 3592/4096 arp_timer
Lsi 001f5a95 0099b264 0056ed50 10 0099a2ec 3800/4096 FragDBGC
Lwe 0011a13f 009a7394 005724b8 60 009a652c 1792/4096 dbgtrace
Lwe 003fb2fd 009a9524 00567688 1045280 009a75dc 6464/8192 Logger
Hsi 003ff455 009ac61c 0056ed50 0 009aa6a4 8024/8192 tcp_fast
Hsi 003ff2f5 009ae6cc 0056ed50 0 009ac754 7916/8192 tcp_slow
Lsi 00314885 00ae4e4c 0056ed50 0 00ae3ec4 3916/4096 xlate clean
Lsi 00314793 00ae5eec 0056ed50 0 00ae4f74 3548/4096 uxlate clean
Mwe 0030be5f 00c862ec 0056ed50 10 00c84354 7744/8192 tcp_intercept_timer_process
Lsi 00452ee5 00d32cc4 0056ed50 0 00d31d3c 3900/4096 route_process
Hsi 002fb6fc 00d33d54 0056ed50 620 00d32dec 2388/4096 PIX Garbage Collector
Hwe 0021e529 00d3e284 0056ed50 30 00d3a31c 13436/16384 isakmp_time_keeper
Lsi 002f929c 00d5abe4 0056ed50 0 00d59c5c 3944/4096 perfmon
Mwe 00214d39 00d85014 0056ed50 30 00d8309c 5264/8192 IPsec timer handler
Hwe 003b105b 00d99424 00591c90 30 00d974dc 7048/8192 qos_metric_daemon
Mwe 0026d0dd 00db3f7c 0056ed50 10 00db0014 13960/16384 IP Background
Lwe 0030cad6 00e66c8c 00585368 170 00e65e14 1872/4096 pix/trace
Lwe 0030cd0e 00e67d3c 00585a98 0 00e66ec4 3704/4096 pix/tconsole
Hwe 0011fa67 00e71b3c 0051bc10 0 00e6e154 14508/16384 ci/console
Hwe 0044c34a 00e7396c 005ebf78 10 00e72a34 3684/4096 lu_ctl
Csi 003048fb 00e74a3c 0056ed50 50 00e73ae4 3296/4096 update_cpu_usage
Hwe 002ef791 00f257e4 0054e100 0 00f2195c 15884/16384 uauth_in
Hwe 003fdf05 00f278e4 0086f530 0 00f25a0c 7896/8192 uauth_thread
Hwe 0041553a 00f28a34 00567c88 0 00f27abc 3960/4096 udp_timer
Hsi 001e7d4e 00f2a6f4 0056ed50 0 00f2977c 3928/4096 557mcfix
Crd 001e7d03 00f2b7b4 0056f1c8 211682050 00f2a82c 3580/4096 557poll
Lsi 001e7dbd 00f2c854 0056ed50 0 00f2b8dc 2200/4096 557timer
Cwe 001e99a9 00f4292c 00756ae0 2209210 00f40a34 5792/8192 pix/intf0
Mwe 004152aa 00f43a3c 008b9720 0 00f42b04 3896/4096 riprx/0
Msi 003ba8a1 00f44b4c 0056ed50 0 00f43bd4 3888/4096 riptx/0
Cwe 001e99a9 00f4ad54 007ce078 2187660 00f48e5c 5916/8192 pix/intf1
Mwe 004152aa 00f4be64 008b96d8 0 00f4af2c 3896/4096 riprx/1
Msi 003ba8a1 00f4cf74 0056ed50 0 00f4bffc 3888/4096 riptx/1
Hsi 0044d191 00f4f1d4 0056ed50 0 00f4e25c 3928/4096 lu_xmit_timer
Hwe 0044be75 00f50274 0056b438 0 00f4f30c 3900/4096 lu_rx
Hwe 001b6151 00f6eb84 005769d0 10 00f6dc1c 2828/4096 fover_thread
Hwe 0011fa67 00f6f8dc 0051bc68 0 00f6ec34 3204/4096 fover_rx
Hwe 001b8f91 00f70bc4 00577064 0 00f6fc4c 3960/4096 fover_tx
Hwe 001b638c 00f72bdc 00577070 0 00f70c64 8056/8192 fover_rep
Lwe 001b6549 00f73c04 00577078 0 00f72c7c 3976/4096 fover_lu_rep
Hwe 001b95e2 00f77c0c 00577080 10 00f73c94 16052/16384 fover_parse
Mwe 004152aa 00fe29cc 008b9690 10 00fe0bc4 5684/8192 radius_rcvauth
Mwe 004152aa 00fe4b9c 008b9648 0 00fe2c74 7644/8192 radius_rcvacct
Mwe 003b2a42 00fe6c9c 00561458 190 00fe4d24 6952/8192 radius_snd
Hwe 00262f75 00ff39d4 0056ed50 40 00ff2a5c 3244/4096 ntp
Hwe 004152aa 00ff4bd4 008b9600 300 00ff3cac 3000/4096 ntp0
Hwe 004152aa 00ff5704 008b9570 0 00ff4d5c 2356/4096 snmp
Hwe 004152aa 00ff6314 008b95b8 0 00ff5fcc 812/1024 snmp_ex
Hwe 003e4e45 00ff90f4 00ff95a4 15490 00ff72cc 4592/8192 isakmp_receiver
Hwe 003fe199 00ffa8dc 00845cb8 0 00ffa294 1196/2048 listen/ssh_1
Mwe 0038707e 01002994 0056ed50 0 01000a1c 7960/8192 Crypto CA
Mwe 003f7ded 010c4b74 0056ed50 0 010c2bfc 6424/8192 ssh/timer
Hwe 003fe199 010d9c0c 00845ea8 0 010d95c4 1196/2048 listen/ssh_0
M* 003f101c 0009ff2c 0056ed88 760 011aec2c 11640/16384 ssh
------------------ show failover ------------------
Failover Off
Cable status: My side not connected
Reconnect timeout 0:00:00
Poll frequency 15 seconds
------------------ show traffic ------------------
outside:
received (in 350418.790 secs):
21291062 packets 945710617 bytes
11 pkts/sec 2000 bytes/sec
transmitted (in 350418.790 secs):
21933773 packets 3992362321 bytes
1 pkts/sec 11000 bytes/sec
inside:
received (in 350418.790 secs):
29635237 packets 4275376926 bytes
11 pkts/sec 12004 bytes/sec
transmitted (in 350418.790 secs):
27464347 packets 2039878679 bytes
4 pkts/sec 5000 bytes/sec
------------------ show perfmon ------------------
PERFMON STATS: Current Average
Xlates 11/s 2/s
Connections 26/s 8/s
TCP Conns 11/s 2/s
UDP Conns 15/s 5/s
URL Access 1/s 0/s
URL Server Req 0/s 0/s
TCP Fixup 301/s 10/s
TCPIntercept 0/s 0/s
HTTP Fixup 94/s 1/s
FTP Fixup 0/s 0/s
AAA Authen 0/s 0/s
AAA Author 0/s 0/s
AAA Account 0/s 0/s
------------------ show running-config ------------------
: Saved
:
PIX Version 6.3(5)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname fw01.hq
domain-name themunicenter.com
clock timezone EDT -5
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
no fixup protocol sip 5060
no fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
no names
name 10.10.20.0 Network_TMCStage
name 10.10.60.0 Network_TMCSecaucus
name 10.9.8.243 INT_Spamdarmad
object-group service SVC_Mail_TCP tcp
port-object eq ssh
port-object eq https
object-group service SVC_Hobbes_TCP tcp
port-object eq https
port-object eq 993
port-object eq 3268
object-group service SVC_Devweb_TCP tcp
port-object eq https
port-object eq 4242
object-group icmp-type SVC_ICMP
icmp-object echo
icmp-object echo-reply
icmp-object unreachable
icmp-object parameter-problem
icmp-object time-exceeded
icmp-object traceroute
object-group service Local_SVC tcp
port-object eq domain
port-object eq pop3
port-object eq imap4
port-object eq ssh
port-object eq telnet
port-object eq smtp
port-object eq www
port-object eq 123
port-object eq https
port-object eq ftp
port-object eq ftp-data
port-object eq aol
port-object eq 4000
object-group service SVC_Restricted_Mail_TCP tcp
port-object eq smtp
access-list INTERNET permit ip any 10.9.0.0 255.255.0.0
access-list INTERNET permit tcp any host 216.57.44.211 object-group SVC_Hobbes_TCP
access-list INTERNET permit tcp any host 216.57.44.213 object-group SVC_Devweb_TCP
access-list INTERNET permit tcp any 10.9.0.0 255.255.0.0
access-list INTERNET permit udp any 10.9.0.0 255.255.0.0
access-list INTERNET permit icmp any any object-group SVC_ICMP
access-list INTERNET permit tcp 64.18.0.0 255.255.240.0 host 216.57.44.210 object-group SVC_Restricted_Mail_TCP
access-list INTERNET permit tcp 207.126.144.0 255.255.240.0 host 216.57.44.210 object-group SVC_Restricted_Mail_TCP
access-list INTERNET permit tcp any host 216.57.44.210 object-group SVC_Mail_TCP
access-list INTERNET permit tcp 209.10.150.64 255.255.255.224 host 216.57.44.211 eq 995
access-list INTERNET permit ip 10.9.0.0 255.255.0.0 10.10.30.0 255.255.255.0
access-list INTERNET permit ip 10.9.0.0 255.255.0.0 10.10.20.0 255.255.255.0
access-list LAN permit icmp any any
access-list LAN deny tcp any any eq 1214
access-list LAN deny udp any any eq 1214
access-list LAN deny ip 209.61.186.0 255.255.255.0 any
access-list LAN deny ip 64.49.201.0 255.255.255.0 any
access-list LAN deny tcp any any range 41000 42000
access-list LAN deny udp any any range 41000 42000
access-list LAN deny ip 64.245.58.0 255.255.254.0 any
access-list LAN deny ip 209.25.178.0 255.255.255.0 any
access-list LAN deny ip 64.124.41.0 255.255.255.0 any
access-list LAN deny tcp any any eq 6699
access-list LAN deny ip 216.35.208.0 255.255.255.0 any
access-list LAN deny tcp any any range 6345 6349
access-list LAN deny udp any any range 6345 6349
access-list LAN permit tcp any any eq domain
access-list LAN permit udp any any eq domain
access-list LAN permit tcp any any eq pop3
access-list LAN permit tcp any any eq imap4
access-list LAN permit tcp any any eq ssh
access-list LAN permit tcp any any eq telnet
access-list LAN permit tcp any any eq smtp
access-list LAN permit tcp any any eq www
access-list LAN permit tcp any any eq 123
access-list LAN permit tcp any any eq https
access-list LAN permit tcp any any eq ftp
access-list LAN permit tcp any any eq ftp-data
access-list LAN permit tcp any any eq 4000
access-list LAN permit tcp any any eq aol
access-list LAN permit ip any any
access-list RMTCLI permit ip 10.9.0.0 255.255.0.0 10.9.14.0 255.255.255.0
access-list RMTCLI permit ip 10.10.20.0 255.255.255.0 10.9.0.0 255.255.0.0
access-list RMTCLI permit ip 10.10.30.0 255.255.255.0 10.9.0.0 255.255.0.0
access-list RMTCLI permit ip 10.10.60.0 255.255.255.0 10.9.0.0 255.255.0.0
access-list RMTCLI permit ip 10.9.0.0 255.255.0.0 10.10.20.0 255.255.255.0
access-list RMTCLI permit ip 10.9.0.0 255.255.0.0 10.10.30.0 255.255.255.0
access-list RMTCLI permit ip 10.9.0.0 255.255.0.0 10.10.60.0 255.255.255.0
access-list INTERNAP permit ip any 10.9.0.0 255.255.0.0
access-list INTERNAP permit tcp any host 216.223.62.15 object-group SVC_Hobbes_TCP
access-list INTERNAP permit tcp any 10.9.0.0 255.255.0.0
access-list INTERNAP permit udp any 10.9.0.0 255.255.0.0
access-list INTERNAP permit icmp any any object-group SVC_ICMP
access-list INTERNAP permit tcp 64.18.0.0 255.255.240.0 host 216.223.62.16 object-group SVC_Restricted_Mail_TCP
access-list INTERNAP permit tcp 207.126.144.0 255.255.240.0 host 216.223.62.16 object-group SVC_Restricted_Mail_TCP
access-list INTERNAP permit tcp 209.10.150.64 255.255.255.224 host 216.223.62.15 eq 995
access-list INTERNAP permit tcp any host 216.223.62.16 eq ssh log
access-list OUTBOUND permit ip any any
access-list 540_TO_601 permit ip 10.9.0.0 255.255.0.0 10.10.30.0 255.255.255.0 log
access-list 540_TO_601 permit ip 10.9.0.0 255.255.0.0 10.10.20.0 255.255.255.0 log
access-list 540_TO_601 permit ip host 67.56.48.194 10.10.20.0 255.255.255.0 log
access-list 540_TO_601 permit ip host 169.193.108.89 10.10.20.0 255.255.255.0 log
access-list noNAT permit ip 10.9.0.0 255.255.0.0 10.10.30.0 255.255.255.0 log
access-list noNAT permit ip 10.9.0.0 255.255.0.0 10.10.20.0 255.255.255.0 log
access-list noNAT permit ip host 169.193.108.89 10.10.20.0 255.255.255.0 log
access-list noNAT permit ip host 67.56.48.194 10.10.20.0 255.255.255.0 log
pager lines 30
logging on
logging timestamp
logging trap debugging
logging facility 23
logging host inside 10.9.8.244
mtu outside 1500
mtu inside 1500
ip address outside 216.223.62.17 255.255.255.224
ip address inside 10.9.8.1 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
ip local pool VPNpool 10.9.14.10-10.9.14.100
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
global (outside) 2 216.223.62.16 netmask 255.255.255.255
nat (inside) 0 access-list noNAT
nat (inside) 2 10.9.8.244 255.255.255.255 0 0
nat (inside) 1 10.9.0.0 255.255.0.0 0 0
static (inside,outside) tcp 216.223.62.16 https 10.9.8.244 https netmask 255.255.255.255 0 0
static (inside,outside) tcp 216.223.62.16 smtp 10.9.8.244 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp 216.223.62.16 ssh 10.9.8.238 ssh netmask 255.255.255.255 0 0
static (inside,outside) 216.223.62.15 10.9.8.246 netmask 255.255.255.255 0 0
access-group INTERNAP in interface outside
access-group LAN in interface inside
conduit permit icmp any any
route outside 0.0.0.0 0.0.0.0 216.223.62.1 1
route inside 67.56.48.194 255.255.255.255 10.9.8.10 1
route inside 169.193.108.89 255.255.255.255 10.9.8.10 1
timeout conn 1:00:00 half-closed 1:00:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:01:00 absolute
timeout xlate 0:01:00
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa-server PDC protocol radius
aaa-server PDC max-failed-attempts 3
aaa-server PDC deadtime 10
aaa-server PDC (inside) host 10.9.8.247 l8n!&ht timeout 10
aaa-server VPNCLNAUTH protocol radius
aaa-server VPNCLNAUTH max-failed-attempts 3
aaa-server VPNCLNAUTH deadtime 10
aaa-server VPNCLNAUTH (inside) host 10.9.8.246 l8n!&ht timeout 10
ntp server 207.46.130.100 source outside
snmp-server host inside 10.9.8.244
snmp-server location 540 Madison
snmp-server contact sysadmin
snmp-server community Retnec1nuM
snmp-server enable traps
tftp-server inside 10.9.8.244 fw01hq.conf
no floodguard enable
sysopt connection permit-ipsec
sysopt connection permit-l2tp
crypto ipsec transform-set normal-des esp-des esp-md5-hmac
crypto ipsec transform-set strong-3des esp-3des esp-md5-hmac
crypto ipsec transform-set strong esp-3des esp-sha-hmac
crypto ipsec transform-set weak esp-des esp-md5-hmac
crypto dynamic-map RMT1 5 set transform-set strong-3des
crypto map RMT 1 ipsec-isakmp
crypto map RMT 1 match address 540_TO_601
crypto map RMT 1 set peer 64.61.73.193
crypto map RMT 1 set transform-set strong
crypto map RMT 1 set security-association lifetime seconds 28800 kilobytes 46000000
crypto map RMT 10 ipsec-isakmp dynamic RMT1
crypto map RMT client configuration address respond
crypto map RMT client authentication VPNCLNAUTH
crypto map RMT interface outside
isakmp enable outside
isakmp key ******** address 64.61.73.193 netmask 255.255.255.255
isakmp identity address
isakmp nat-traversal 20
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
isakmp policy 2 authentication pre-share
isakmp policy 2 encryption 3des
isakmp policy 2 hash sha
isakmp policy 2 group 1
isakmp policy 2 lifetime 86400
isakmp policy 3 authentication pre-share
isakmp policy 3 encryption 3des
isakmp policy 3 hash sha
isakmp policy 3 group 2
isakmp policy 3 lifetime 64800
isakmp policy 4 authentication pre-share
isakmp policy 4 encryption 3des
isakmp policy 4 hash md5
isakmp policy 4 group 2
isakmp policy 4 lifetime 28800
isakmp policy 5 authentication pre-share
isakmp policy 5 encryption 3des
isakmp policy 5 hash sha
isakmp policy 5 group 2
isakmp policy 5 lifetime 28800
isakmp policy 6 authentication pre-share
isakmp policy 6 encryption 3des
isakmp policy 6 hash sha
isakmp policy 6 group 2
isakmp policy 6 lifetime 86400
isakmp policy 8 authentication pre-share
isakmp policy 8 encryption des
isakmp policy 8 hash sha
isakmp policy 8 group 2
isakmp policy 8 lifetime 86400
isakmp policy 9 authentication pre-share
isakmp policy 9 encryption des
isakmp policy 9 hash md5
isakmp policy 9 group 2
isakmp policy 9 lifetime 86400
vpngroup clivpn address-pool VPNpool
vpngroup clivpn dns-server 10.9.8.246
vpngroup clivpn default-domain hq.themunicenter.com
vpngroup clivpn split-tunnel RMTCLI
vpngroup clivpn idle-time 18000
vpngroup clivpn password ********
vpngroup clivp idle-time 1800
telnet timeout 5
ssh 171.68.225.213 255.255.255.255 outside
ssh 10.9.8.154 255.255.255.255 inside
ssh 10.9.8.173 255.255.255.255 inside
ssh timeout 60
management-access inside
console timeout 0
terminal width 80
Cryptochecksum:7ad6139e85c03c5251360453ea864225