Can PIX 506e return port unreachable

Hello
Can PIX 506e return ICMP port unreachable on Linux traceroute with UDP data gram, and if somebody knows how, can you make an example of the access-list how it should be written to allow this response?

PIX won't return an ICMP port unreachable message and access lists cannot be configured to make PIX to respond a port unreachable.

Similar Messages

Ping return a lot of "ICMP Port Unreachable from gateway"

hi all,
continues getting many "ICMP Port unreachable" messages while i ping a host that is within same subnet. both servers are running solaris 10 U6. is there any wrong configuration of IPMP ?
PING rac-dbs-a2: 1024 data bytes
1032 bytes from rac-dbs-a2 (10.1.3.27): icmp_seq=0. time=0.830 ms
1032 bytes from rac-dbs-a2 (10.1.3.27): icmp_seq=1. time=0.608 ms
1032 bytes from rac-dbs-a2 (10.1.3.27): icmp_seq=2. time=0.547 ms
1032 bytes from rac-dbs-a2 (10.1.3.27): icmp_seq=3. time=0.611 ms
1032 bytes from rac-dbs-a2 (10.1.3.27): icmp_seq=4. time=0.543 ms
1032 bytes from rac-dbs-a2 (10.1.3.27): icmp_seq=5. time=0.616 ms
1032 bytes from rac-dbs-a2 (10.1.3.27): icmp_seq=6. time=0.663 ms
1032 bytes from rac-dbs-a2 (10.1.3.27): icmp_seq=7. time=0.596 ms
1032 bytes from rac-dbs-a2 (10.1.3.27): icmp_seq=8. time=0.672 ms ICMP Port Unreachable from gateway rac-dbs-a2 (10.1.3.27) for udp from rac-dbs-c2 (10.1.3.36) to rac-dbs-a2 (10.1.3.27) port
37833
1032 bytes from rac-dbs-a2 (10.1.3.27): icmp_seq=9. time=0.582 ms
----rac-dbs-a2 PING Statistics----
10 packets transmitted, 10 packets received, 0% packet loss round-trip (ms) min/avg/max/stddev = 0.543/0.6268/0.830/0.0828
ifconfig -a
lo0: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu
8232 index 1
inet 127.0.0.1 netmask ff000000
bge0: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 2
inet 192.168.1.27 netmask ffffff00 broadcast 192.168.1.255
groupname internal-multipath
bge0:1:
flags=201040843<UP,BROADCAST,RUNNING,MULTICAST,DEPRECATED,IPv4,CoS> mtu 1500 index 2
inet 192.168.1.37 netmask ffffff00 broadcast 192.168.1.255
bge1: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 3
inet 172.22.100.27 netmask ffffff00 broadcast 172.22.100.255
groupname smtm-multipath
bge2: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 4
inet 10.1.4.27 netmask ffffff00 broadcast 10.1.4.255
groupname crf-multipath
bge2:1: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 4
inet 0.0.0.0 netmask ff000000 broadcast 0.255.255.255
bge3: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 5
inet 10.1.3.27 netmask ffffff00 broadcast 10.1.3.255
groupname rac-multipath
bge3:1: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 5
inet 0.0.0.0 netmask ff000000 broadcast 0.255.255.255
ce0: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 6
inet 0.0.0.0 netmask ff000000 broadcast 0.255.255.255
groupname internal-multipath
ce1: flags=201000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4,CoS> mtu 1500 index 7
inet 0.0.0.0 netmask ff000000 broadcast 0.255.255.255
groupname smtm-multipath
ce2:
flags=249000842<BROADCAST,RUNNING,MULTICAST,IPv4,NOFAILOVER,INACTIVE,CoS
mtu 0 index 8inet 0.0.0.0 netmask 0
groupname crf-multipath
ce3:
flags=249000842<BROADCAST,RUNNING,MULTICAST,IPv4,NOFAILOVER,INACTIVE,CoS
mtu 0 index 9inet 0.0.0.0 netmask 0
groupname rac-multipath
Edited by: hello78 on May 11, 2009 9:02 PM

This isn't a Java question. Try the Solaris forum.

Pix 506e firewall configring for mail( Exhange), Web, FTP server

Hi
I am Hemant, We have pix 506e firewall, D-link ADSL dsl-502t and my IBM xseries 236 server.
I have fix static live ip 59.181.103.220 which i have got ISP (MTNL), and the same ip is given in fqdn in www.net4india.com (a company from where we have registered domaim name and taken space)
My problem is i am not able to send mail through my mail server (loyalindia.co.in)but i am receiving mails from any server.
My network design is as fallows:-
ADSL (WAN)59.181.103.220, ADSL (LAN)59.181.103.221. Pix 506e (out) 59.181.103.222, Pix 506e (in) 192.168.1.1. My domain mail server loyalindia.co.in (Exchange server) ip 192.168.1.2
I am tryied with (ADSL)natting and without natting but the problem is same.
If i am removing the pix 506e and directly connecting the server to adsl i am able to receive and send mails properly.
can anybody who can support me?.

Hello
I think there won't be one QUCK START to get all of this up and running, there are multiple examples on the following page, a few that might help would be:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/prod_configuration_examples_list.html
PIX/ASA : Connecting Three Internal Networks with Internet Configuration Example
PIX/ASA : Connecting Two Internal Networks with Internet Configuration Example
ASA 7.x/PIX 6.x and Above: Open/Block the Ports Configuration Example
PIX/ASA 7.x: Enable VoIP (SIP, MGCP, H323, SCCP) Services Configuration Example
PIX/ASA 7.x and FWSM: NAT and PAT Statements
PIX/ASA 7.x and later : Port Redirection(Forwarding) with nat, global, static and access-list Commands
Configuring PIX Firewall with Mail Server Access on the DMZ
Configuring the PIX Firewall with Mail Server Access on Inside Network
Please rate if you find the post helpful.
Regards
Farrukh

Can't open local port

Hello all
I would be very grateful for some help with this problem,I haven;t been able so solve and i have spend a lot of time on it
I have written my own client RTSP code,from this i can set the client ports i want to recieve and send RTCP and recieve RTP,and can read in the server ports
So i have something like 157.190.181.36 60972 60973 client
157.190.181.36 6972 6973 server
To handle RTP i have used RTP socket player or RX and may other RTP reciver options,as in the java solutions etc ,so that i can recieve RTP and create a player
When i run them i get the same eror from all error can't open local port
Further information
I am on a LAN,but hav tried my set up disconnected from the LAN through a hub set up
I have tried opening the ports before callled the RTP players i.e
on the client side
DatagramSocket RTPsocket3= new DatagramSocket(60972);
DatagramSocket RTPsocket4= new DatagramSocket(60973);
Through sniffers
I know the RTSP messages are OK
I recive an ICMP message destination unreachable
I am connecting to darwin streaming server and i can connect to this and play through apple quicktime player or JM studioTHANKS IN ADVANCE!

Hey...
I'm having a similar problem, because i'm developing an application that its serving RTP audio context streams. So the application would transmit a playlist of files over RTP, and it works fine for one file, but when i try to give it a new file, i always get the exception "Can�t open door: ...". This error occurs on the line that is marked with *****.
I'm creating a processor for each file i want to transmit, for the same port and same IP address, so when the first file ends i close the processor and create a new one with the same properties, but with a diferent file...
I really nead this to work, so if someone could help me on this it would be really appreciated... Thanks in advance...
My code for creating the transmitter is like this:
private String createProcessor(){
     if (locator == null) return My_Dictionary.TRANSMIT_LOCATOR;
          try{
          ds = javax.media.Manager.createDataSource(locator);
          }catch (Exception e){
          return My_Dictionary.TRANSMIT_DATASOURCE;
          try{
          processor = javax.media.Manager.createProcessor(ds);
          }catch (NoProcessorException npe){
          return My_Dictionary.TRANSMIT_PROCESSOR;
          }catch (IOException ioe){
               return My_Dictionary.TRANSMIT_IO_PROCESSOR;
          boolean result = waitForState(processor,Processor.Configured);
          if (result == false) return My_Dictionary.TRANSMIT_PROCESSOR_CONFIG;
          TrackControl [ ] tracks = processor.getTrackControls();
          if (tracks == null || tracks.length < 1) return My_Dictionary.TRANSMIT_TRACKS;
          ContentDescriptor cd = new ContentDescriptor(ContentDescriptor.RAW_RTP);
          processor.setContentDescriptor(cd);
          Format supported[];
          Format chosen;
          boolean atLeastOneTrack = false;
          for (int i = 0; i < tracks.length; i++){
          if (tracks.isEnabled()){
                    supported = tracks[i].getSupportedFormats();
                    if (supported.length > 0){
                         for (int j = 0; j < supported.length; j++){
                              if (supported[j] instanceof AudioFormat){
                                   if (supported[j].matches(Transmit.audioformat)){
                                        chosen = supported[j];
                                   tracks[i].setFormat(chosen);
                                   atLeastOneTrack = true;
                                   System.out.println("Track " + i + " is set to transmit as: " + chosen);
                    }else tracks[i].setEnabled(false);
          }else tracks[i].setEnabled(false);
          if (!atLeastOneTrack) return My_Dictionary.TRANSMIT_ANY_TRACKS;
          result = waitForState(processor,Controller.Realized);
          if (result == false) return My_Dictionary.TRANSMIT_PROCESSOR_REALIZE;
          dataOutput = processor.getDataOutput();
          return null;
private static String createTransmitter(){
          PushBufferDataSource pbds = (PushBufferDataSource)dataOutput;
          PushBufferStream pbss[] = pbds.getStreams();
          rtpMgrs = new RTPManager[pbss.length];
          SessionAddress localAddr, destAddr;
          InetAddress ipAddr;
          SendStream sendStream;
          int port;
          for (int i = 0; i < pbss.length; i++){
          try{
                    rtpMgrs[i] = RTPManager.newInstance();
                    port = portBase + 2*i;
                    ipAddr = InetAddress.getByName(ipAddress);
                    localAddr = new SessionAddress(InetAddress.getLocalHost(),port);
                    destAddr = new SessionAddress(ipAddr,port);
                    rtpMgrs[i].initialize(localAddr); *****
                    rtpMgrs[i].addTarget(destAddr);
                    System.out.println("Created RTP session: " + ipAddress + "/" + port);
                    sendStream = rtpMgrs[i].createSendStream(dataOutput,i);
                    sendStream.start();
          }catch (Exception e){
                    return e.getMessage();
          return null;

Manual for PIX 506E?

Hi everyone! I just became in charge of a PIX 506E, which I have no experience with. I was not told how it was set up, what the password is, etc...Oh, and the dongle for the console connection is non-existent as well.
On Cisco's website, I can't find any manuals for it. The only documentation I could find was a quick setup guide, which is not helpful at all if it is already set up.
Basically, I am looking for any help anyone can provide so that I can get into the interface for the PIX 506E so I can see how things are set up and to change things in the future. Thank you in advance!

This could be a long journey or a short one, but for sake to help you here we go..
When I say long journey it is because all depends on what type of resources you have at hand, at least you have us in netpro, but more specifically if you do not know the admin password for the PIX that is number one headache, you need password recovery procedure, please try to make an effort to obtain the password to not go through all these procedures, if you cannot then you need password recovery .
See password recovery.
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_password_recovery09186a008009478b.shtml
Please have handy these tools
1- Console cable to connect to COM port in PC and PIX console port
2- Terminal emulator - hyperterminal
3- Mini hub to connect your PC and pix pysical interface to it
4- tftp server software running on your PC
Follow instructions on link.
As for instructions about the PIX there are hundreds of documentation in Cisco website, we can direct you to them but first you need to gain access to PIX.
HTH
-Jorge

Raw Socket always drop packets and return Destination Unreachable

Ho folks,
I have an application program that opens a raw socket to expect for UDP message incoming from the network.
However everytime I receive a package the Solaris 10 OS return a ICMP - Destination (port) unreachable, and no message
is send to my application.
I did test the same application in linux and it worked well, all that I have to do was disable ICMP responses using iptables.
Just to make things clear:
In linux the OS was sending the ICMP - Destionation (port) unreachable, however my program was
receiving the packets anyway. So just to stop those messages I did use the iptables. However, in
Solaris 10 the ICMP response is sending back and no message is forward to my application.
Would your guys help me to solve that?
Thanks in advance

Folks, here I go again...:-)
I have been spent some time, trying to figure out why it is not work. I read in books and internet, that BSD raw sockets DO NOT allow us to receive TCP/UDP packages. However the linux implementation DOES allow. That is because it work in linux but not in solaris.
Given that, such information is 100% true (book: Unix NetworkProgramming, 3rd edition), I would like to ask your guys what I can do to solve my problem.
Basically what I need is create an application that:
1) Allows to bind thousand of sockets at the same time (it is a media server that handles thousand of RTP connections)
This I believe I can do using socket multiplexing (e.g. select() )
2) Read not only the packet data, I need to retrieve the whole packet address (including IP, UDP, Upper Layers...)
When using SOCK_DGRAM with IPPROTO_UDP, I can get the messages but I can't get the IP header
3) Uses something like raw socket to send messages, here I believe I can use raw socket with no problem, is just sending messages
Thanks and Regards

How can I use two ports in the same time?

My application need one pc use two ports the same time.But when I open one port and my systerm is running the other port can't be opened.
I use the frame API in VC++6.0.
My OS is win2000 server;
The functions I used are ncOpenObject();

Hi DickW
Thank you for your help!
I have tried the example.But the example shows how to connect one CAN network with two ports.
I want each port connect to the net can both read and write;
I want to apply the function like this:
1.config the port1 and port2
2,open port1 and port2
But after I open port1 or port2 the other port can't be opened;
After I open the second port it always returns negative.
In the codes I use CAN0 and CAN1 as the CAN objects.
Attachments:
twoport.zip ‏1184 KB

I have just had my hard drive replaced and now I can.t find Air Port to get wi fi

I have just had my hard drive replaced and now I can't find Air Port for my wi fi

Go to your Applications folder>Utilities>AirportUtility.app>and there set up your Airport service. Then return to your Applications folder>Sytem Preferences>Network> and there turn on the WiFi on your iMac.
Hope this helps

Linksys WRT600N vs CISCO PIX 506E.... Firewall / Routing Performance

Hi:
I am new to the forum and was hoping to tap into some of your expertise. I have a Linksys WRT600N version 1.1 and I recently acquired a CISCO PIX 506E firewall. My question is what should I use as a firewall? Both have SPI etc. Should I:
a) Use the 506E as a firewall and use the 600 as a wireless access point, or
b) Use the 600 as a firewall and wireless access point.
Do both routers have the same firewall routing performance? I want to use the storage feautre on the 600N, but if I do that and use it as a wireless access point the 600 can't get the proper time from the Internet, so my time for newly created folders and files shows they are 10 years old.
Anyway, just thought I would post and find out what some of the experts thought and maybe someone from Linksys or CISCO. I know the 506E is discontinued and was manufactured around 2001 and the 600N is a new model.
(Edited subject to keep threads from stretching. Thanks!)
Message Edited by JOHNDOE_06 on 05-06-2008 10:41 AM

The PIX is a real firewall. The WRT has a firewall which mostly protects the router itself. People prefer to buy a "SPI firewall router" instead of a simple "router" even though the router firewall does nothing or little to protect the LAN. The only firewall configurations on the WRTs you can usually do is on the Access Restrictions tab. But that's usually all. The LAN itself is not protected by the firewall. You would notice this if you had a public IP subnet and ran it through the WRT: the LAN would be fully exposed to the internet. Some routers have a few functions like protection against denial of service attacks or similar. But even then this often filters only the traffic targeted at the router and not the LAN.
The common protection of your LAN you have on the WRT is because you use private IP addresses inside your LAN and the router does NAT. However, NAT is not a security mechanism but a mechanism to solve the problem that you can only have a single public IP address but want to use multiple computers, which is why you have to use private IP addresses. Current NAT implementations usually drop unsolicited incoming traffic because they don't know to which IP address in the LAN to send it to. But the notion of NAT is to deliver and to allow connectivity. This has nothing to do with security or a firewall.
Thus, if you want to use a real firewall use the PIX. On the PIX you can configure the traffic which is allowed to enter the LAN and which not. It is far superior in this respect to the WRT. However, as it is a older model, I cannot tell how fast the PIX is. You should be able to find the old data sheets of the PIX somewhere on the cisco website. They should mention the possible throughput. I guess it won't be an issue.
To me another point for the PIX are the VPN capabilities which allow you to securely access your LAN while you are on the road.
Of course, you must know how to configure the PIX correctly. It is a complex device and can be configured pretty much for anything you like. This means of course if you do it wrong you may end up with little or no security.
BTW, there are no people from linksys in this forums except the moderators (which may be from lithium). To hear from Linksys you have to contact Linksys support.

PIX 506E routes died

Hello experts...
I've had a set of PIX 506E boxes holding an IPSEC tunnel for a good year or so without a hitch. Today, the tunnel dropped and I lost access to the remote site. The local PIX can only ping devices on the local [inside] subnet and all nodes on all my other subnets can't find a route to the PIX. On the local gateway, I can ping the PIX, but can't traceroute to it. I also ran an ICMP debug and could see when remote nodes ping, but the reply doesn't leave the box.
Nothing has changed, routes all look good, i've reset everything -- no luck at all. Any idea what may be happening? I have a feeling it's a basic issue that looks more complex that it is, but i'm stumped at this point.
Any help would be greatly appreciated!
Thanks,
Jad

Use this Cisco PIX 500 Series Security Appliances Troubleshoot and Alerts
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/tsd_products_support_troubleshoot_and_alerts.html

Pix 506e as Content Filter

Is there any way to effectively use a Pix 506e as a content filter? I see some example configurations involving an ASA 5500, but I was wondering if the pix alone will allow content filtering. We are a small business that is looking to restrict just a few websites to our DHCP users. (i.e. eBay, yahoo mail, Amazon). We already have the pix. Thanks!

Suppose if you want to filter streaming media content with PIX 506E, you have two options. The first one is to block ports on the PIX and the second is to use Proxy Server to filter URLs. Since our main concern is doing it on the PIX, You may enter these commands on the PIX for well-known ports that you could block on the firewall:
access-list nostream deny udp any any eq 2979
access-list nostream deny udp any any eq 1790
access-list nostream deny udp any any eq 1755
access-list nostream deny udp any any eq 1736
access-list nostream deny udp any any eq 554
access-list nostream deny udp any any eq 537
access-list nostream deny tcp any any eq 2979
access-list nostream deny tcp any any eq 1790
access-list nostream deny tcp any any eq 1755
access-list nostream deny tcp any any eq 1736
access-list nostream deny tcp any any eq 554
access-list nostream deny tcp any any eq 537
access-list nostream permit tcp any any eq 80
access-list nostream permit ip any any
access-group nostream in interface inside
However, some streaming applications use random ports using auto-configure options that are difficult to block with the PIX. To resolve this issue, you have the second option, using a proxy server to filter the URLs. You may use Websense and any other software to filter web traffic.

ICMP Port Unreachable

Can someone clarify what the exception java.net.PortUnreachableException: ICMP Port Unreachable indicates (aside from the obvious)? Here is the scenario: using UDP I have a client application, a gateway application, and a server application. The client sends to the server through the gateway and vice versa. I have created 2 sockets, one between the client and the gateway and one between the gateway and the server. When I try to send from the gateway to the client the packet never makes it to the client (server side is fine). When I call sock.getLocalSocketAddress and sock.getRemoteSocketAddress both are 0.0.0.0 (the latter at least has the right port number). The gateway acts as a server for the client and as a client to the server. I tried to fix this using sock.connect on the gateway side for the client facing socket but this eventually generates the ICMP port unreachable exception on the gateway side when receiving from the client.
Thank you in advance.

It means there is no UDP connectivity between whatever host gets the exception and whatever host that socket is connected to. Typically a firewall problem.
The addresses of 0.0.0.0 just mean that the socket is bound to all interfaces, it's not a problem.

PIX 506e - cannot browse startup.html

I just got a PIX 506e from a friend that was not longer using it. I'm trying to get started with the configuration page. I've reset it to factory defaults, rebooted and connected up ethernet. I can ping the device at 192.168.1.1 and access it via console. I browse the site https://192.168.1.1/startup.html, get the invalid ssl certification, get a login prompt (user/pass) and as the document says I leave it blank. As soon as I hit ok it goes to the 404 error Page Not found.
Thanks in advance!
second part, anyone have a good article/document on standard configurations via cli? I worked my way through
http://www.dslreports.com/faq/15785 but didn't have any luck. Thats why I want to start with the web config then work into CLI.

I meant to reply sorry.
I found out that its 6.3 but that the previous owner removed PDM. I found the download on cisco HOWEVER I don't have an account so I have no way of actually downloading the PDM or 6.3 with pdm bin file.
do you know where I can get that?
thanks

Pix 506e

Hi,
We have planning to Purchase Cisco Pix 506E Firewall. We are having 50
Computers & Users.If we purchase Pix 506E Firewall,its require to purchase
any aditional license.
with regds
prem

For the PIX 506E there is only one license that can be purchased which is the 3DES/AES and DES Encryption Licenses. Right now I think you can download that license for free. The following link will provide you with details on that license and the data sheet on that PIX (scroll down about half way for the license information).
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_data_sheet09186a0080091b13.html
The following link will give you the data sheet and describe the three different licenses available with upper models of the PIX as it relates to the 515E (restricted, unrestricted, and failover).
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_data_sheet09186a0080091b15.html

ISAKMP spi size buffer overflow for PIX 506e

Hello,
We have perform a vulnerability scan for our network and found a high risk vulnerability result as stated below:
"H IsakmpSpiSizeBo: ISAKMP spi size buffer overflow
Additional Information More Information
Internet Security Association and Key Management Protocol (ISAKMP) is a key exchange protocol signature. ISAKMP is vulnerable to a
buffer overflow. A remote attacker can send a specially-crafted ISAKMP payload to a vulnerable VPN client or server to overflow a buffer
and execute arbitrary code on the system, possibly with administrative privileges.
The supported operating systems in the Platforms Affected list are only vulnerable if they use the LibKmp ISAKMP library. Only VPN
or firewall products which implement the Entrust LibKmp ISAKMP library are vulnerable.
Remedy:
Apply the appropriate hotfix for this vulnerability, as listed in the Symantec Security Response SYM04-012 and available from the
Symantec FTP Update Web site. See References."
I have search it on cisco but found no clue on resolving the issue. Our firewall is PIX 506E model.
Your inputs are highly appreciated.
Thank you
Neil

The cause of the issue was the remote peer, the parameters of phase 2 were wrong

Can PIX 506e return port unreachable

Similar Messages

Maybe you are looking for