Trouble with PIX 501 user limit?

I have installed a Cisco PIX 501 at a client's site, and now a couple of weeks later we are having an issue where some computers cannot access the Internet. The PCs can ping the internal interface of the firewall, and can resolve hostnames. But about three of them cannot ping public IP addresses. I thought the arp cache might be corrupted on the switch, so we restarted that to no good effect.
I suspect that the client has somehow run up against the 10-user limit for their PIX 501 license.
The site has eight PCs and a server, so it doesn't seem like they should be going over the 10-user limit.
I'm not much of an expert when it comes to the PIX, so I wonder if someone can tell me how to determine whether this is the case, and maybe give me some tips on how to resolve the issue?
Thanks very much for any advice you can offer.
Best regards,
Zac

Any chance you can help me make sense of this? Does it really look like we have exceeded the number of allowed connections by over 3400?
pixfirewall# show local-host
Interface inside: 10 active, 10 maximum active, 3493 denied
local host: <192.168.1.2>,
TCP connection count/limit = 12/unlimited
TCP embryonic count = 2
TCP intercept watermark = unlimited
UDP connection count/limit = 0/unlimited
AAA:
Xlate(s):
PAT Global 67.115.121.230(38600) Local 192.168.1.2(3553)
PAT Global 67.115.121.230(51033) Local 192.168.1.2(3215)
PAT Global 67.115.121.230(51037) Local 192.168.1.2(3230)
PAT Global 67.115.121.230(51050) Local 192.168.1.2(3271)
PAT Global 67.115.121.230(55215) Local 192.168.1.2(4084)
PAT Global 67.115.121.230(55228) Local 192.168.1.2(4136)
PAT Global 67.115.121.230(55231) Local 192.168.1.2(4139)
etc, etc.

Similar Messages

DMZ zone with PIX 501

- How do I setup a DMZ zone with PIX 501 firewall? Do I need to use an additional router? I have CISCO 1605 at my disposal.
- If I can't do that, what would be an alterantive way to set an FTP server similarly to the DMZ way.
(We're using IPsec/GRE VPN between our 3 sites. we're on W2K network).
thanks,
oleg

When talking about setting up a DMZ, a PIX model with atleast three interfces is required. On a PIX 501, only two interfaces are available, an outside interface (ethernet) and an inside interface (availabe as a 4 port switch). For stting up a DMZ, you will need an additional interface and that would mean getting a higher model of the PIX. The idea of using a router on the inside interface and then configuring restrictive policies on it might work but will make the setup messy and you are unlikely to find a satisfactory level of support for it for the simple reason that not many neworks are deployed that way.

Manual key negotiation with pix 501

how to use manual key negotiation with pix 501 6.3 to solve VPN tunnel negotiation problem

http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/ipsecint.html#wp1045493
"Manual configuration of SAs is not supported on the PIX 501 because of the restriction in the number of ISAKMP peers allowed on that platform."
However I'm sure a proper solution can be found to your original problem (establishing VPN with huawei)
Please rate helpful posts.
Regards
Farrukh

I'm having trouble with using Calculated-User Can Override, it will not honor my overide

I'm having trouble with using Calculated-User Can Override, it will not honor my overide. I'm using LiveCycle Designer ES v.8.2

Reset the device:
Press and hold the Sleep/Wake button and the Home button together for at least ten seconds, until the Apple logo appears.
If that doesn't help, tap Settings > General > Reset > Reset All Settings
No data is lost due to a reset.

Pix 501 user logging report

I am running a pix 501 ver 6.1 with tacacs 3.0 server runninfg on a NT box.
I have all the user authenticated via tacacs going inbound and outbound
and have setup accounting as well.
I would like to find a EASY way to compile a report to find out what the users
are accessing both application and source and destination ip address.
If i check reports option through tacacs it only shows me what time the
user is validated and the application type not the source or dest address.
If i setup syslog server and setup logging console debug it shows me the source and destination and user sent to the syslog server.
Is their any way to manipulate this syslog report or is their another feature
within tacacs.
thanks

You might look at www.opensystems.com. They are a Cisco partner that developed a reporting program called Private I. They have an eval available to take a look at.

Trouble with reauthenticating NAC users after laptop is out of hibernation

Hi,
Have trouble with users logging back on to laptops that comes out of hibernate mode. NAC agent pops up saying " Client Access Server not available on the network"
The current solution I have now is to run Kerbtray.exe too clear the kerberos tkts. which i believe is expired.User logs in fine after clearing.
Is there any alternate permanent soln. in 4.7.2 ver
Thanks in advance
Satish

One more point i forgot to mention
Laptops have full disk encryption installed and encrypts the drive when it goes into hibernation .At the same time the sw port is set to move it to auth vlan after the link down trap is received by the sw.
thanks again
Satish

Q about DNS with PIX 501 as PPPoE client

Hi!
I've got PIX 501 (PixOS 6.3.5) acting as PPPoE client. Outside interface gets IP and DNS addresses from access concentrator.
There is an example in config guide how to set DNS address (got from concentrator) for DHCH daemon in PIX, so clients in LAN can get that DNS address so.
But I don't use DHCP in LAN. Is there a way to set PIX inside address as DNS on LAN clients and make PIX somehow redirect DNS request to PPPoE DNS server by itself? (same as on simplest linux-build SOHO box by Linksys etc)
Thanks!

In this example, the intent is for the machines in the 10.10.10.0 /24 network to access this web server in the DMZ by its external You do not want the PIX to do DNS Doctoring of the DNS replies. Instead, you want the PIX to dnat the external (global) IP address of the web server to its "real" DMZ address (192.168.100.10).
Use the alias command to perform dnat:
alias(inside) 10.99.99.99 192.168.100.10 255.255.255.224

Span port with Pix 501?

I want to use an open source IDS for my small network. I have a Pix 501 and I would like to span one of the ports from the integrated four port switch so my IDS can see all the traffic. Is this possible or is the integrated switch too basic? I have a Cisco 3550 in storage that I could use if needed, but I really don?t have a good place to put it. Thanks in advance!

Hi .. yes infact the swith on the 501 is basically for extending your port density limits.
I suggest you connecting the desired port to a hub and then plug the IDS to the hub. The IDS will then get all the packets ..
I hope it helps ... please rate it if it does !!!

Trouble with DeployManager and user administrator

i have the following error during the task of deployment of a WD app. The user administrator isn't blocked coz' i unblocked recently. but it continue show me that error. Any idea to solve my problem. Thanx in advance
this is the log:
Settings
SDM host : veccs1011
SDM port : 50218
URL to deploy : file:/C:/DOCUME1/Mariana/LOCALS1/Temp/temp34919MyWDproject.ear
Result
=> deployment aborted : file:/C:/DOCUME1/Mariana/LOCALS1/Temp/temp34919MyWDproject.ear
Aborted: development component 'MyWDproject'/'local'/'LOKAL'/'0.2006.05.09.15.43.06':
Caught exception while checking the login credentials for SAP J2EE Engine. Check whether the SAP J2EE Engine is up and running.
com.sap.engine.deploy.manager.DeployManagerException: ERROR: Cannot connect to Host: [veccs1011] with user name: [Administrator] Check your login information. Exception is: com.sap.engine.services.jndi.persistent.exceptions.NamingException: Exception while trying to get InitialContext. [Root exception is com.sap.engine.services.security.exceptions.BaseLoginException: Access Denied.]
(message ID: com.sap.sdm.serverext.servertype.inqmy.extern.EngineApplOnlineDeployerImpl.checkLoginCredentials.DMEXC)
Deployment exception : The deployment of at least one item aborted

Hi
WHy dont you try changing the sdm password . have a llok at this forum thread for changing the sdm password
SDM password not working
Hope this helps , please mark points for helpful answers.
regards
rajeshkr

Having trouble with multiple wireless users on WRT54G router

Basically, there are 3 of us wirelessly sharing the internet via a linksys WRT54G router. I have our router password-protected, to avoid randoms stealing out broadband. I am a Mac user (3 year old computer), the other 2 are on PC laptops.
At the moment, I have an excellent internet connection, and it's working just fine. However, if my room mate connects with their laptop (a fairly new model), my internet connection stops working. I still have a signal, but it just really slows down/often stops working entirely. It's as if their wireless connection takes priority and ignores mine (essentially nullifying the router's purpose).
Has anyone come across a problem like this before? Your assistance would be super helpful and appreciated.

Hi, perhaps you may try the following steps to improve the performance of your router:
• Upgrade the router’s firmware
• Reset the router after the firmware upgrade
• Optimize the router’s wireless settings
• Use a wifi analyzer like http://www.metageek.net/products/inssider/ to set a non overlapping channel to the router
• Relocate the router on a more central location for better wireless coverage
• Avoid placing the router on a glass or metallic surface

[SOLVED] Trouble with running systemd user service on login

I'm trying to get emacs to run as a systemd/user service so that it will start up faster, as suggested in the wiki article, but I'm having some problems.
I can't get the service to run as soon as I log in. I can run the service with
systemctl --user start emacs
and it will run for the rest of my session, but if I try to run
systemctl --user enable emacs
I get the following error:
The unit files have no [Install] section. They are not meant to be enabled
using systemctl.
Possible reasons for having this kind of units are:
1) A unit may be statically enabled by being symlinked from another unit's
.wants/ or .requires/ directory.
2) A unit's purpose may be to act as a helper for some other unit which has
a requirement dependency on it.
3) A unit may be started when needed via activation (socket, path, timer,
D-Bus, udev, scripted systemctl call, ...).
I ran
systemctl --user is-enabled emacs
and that returned
static
but I'm not sure what that means. Any help would be greatly appreciated.
Last edited by whitebrice (2014-06-28 17:20:13)

Are you sure there isn't a typo in your unit file? The example you linked to in the wiki does have an [Install] section.
Post your ~/.config/systemd/user/emacs.service file here so we can take a look.

PIX 501 keeps rebooting

Hi,
We have four remote sites with PIX 501's.
They are approximately two years old, but we are unaware of how long this issue has persisted.
We have found all of them incredibly sensitive to movement. If you stamp on the floor near one of them, it will reboot.
If you keep a console cable connected, you can see it just looks like a power cycle, as though there was a short or a small power outage.
What gets me is, it seems to affect all of them.
We are finding this difficult to deal with because it brings the VPNs we run offline, and they often take some time to reconnect.

Hi,
We have taken the devices out of their homes and tested in our office, so it's not a power outlet issue.
We have swapped power supplies, but as all four have the issue, it's hard to rule out the supplies.
Insultating material would only be a temporary fix, as they are SO sensitive, I doubt we could really protect them. Is this common?

Problems with second (admin) user profile

Hi all,
I'm having trouble with a certain user profile. I got a new MacMini with Lion (10.7), to which I imported two user profiles from a Time Machine backup of a Snow Leopard system. The first profile, which used to be the admin profile on the old Mac, works just fine. But the second profile, which used to be a "normal" user profile encounters massive problems. First thing I did was to make the second user admin as well, but that did not fix anything. I assume there is a problem with the permissions and "repair permissions" didn't do anything either.
Here are some examples of the issues:
First example: I cannot delete or rename folders in Mail, unless I delete or rename them in the respective ~/Library folder. This concerns folders which I imported from the Time Machine backup. There are no issues with new folders.
Second example: I cannot start SPSS, which runs just fine on the other profile. It starts and then just closes right away without any error message or anything. I found a workaround which is to start the program with a rooted terminal command ("sudo /Applications/..."). There is no problem with Java (which would be common) and there are no license issues. I found an article in some other forum which stated that SPSS reads and writes in its preference folder at startup and closes right away if permissions are denied for that folder.
Third and most annoying example: I cannot permanently delete or create icons in the dock. I can remove or create icons temporarily, but after restarting the Mac, the new icons are gone and the deleted items are right back where they were.
Does anybody have any idea on how to fix this?
In the short run, It'd be very helpful if anyone could tell me how to create dock icons with a Terminal command.
I thank you in advanced for helping me out. Every little hint is appreciated.
Sebastian
PS: I have not tried to setup a new user profile instead of the second profile, yet. With all the programs and preferences that would take at least two days and I need to keep the Mac running. I would only do it as a very last resort.

Well i went ahead and made that new admin like you said and I set it up and transfered only the files that I thought were important to me, Then i went ahead and fixed or repaired the permissions On the new admin user name and deleted my other admin profile with the key board issue.I fixed the permmissions with an OSX Lion boot disk instead of lion because I don't have the Mountain lion DVD anymore. Every thing seems ok but was that a smart move or will that come back to haunt me?
Now what Im worried about now is I didnt keep any of the certificates or anything in that nature, So My final question is What should i do now to hands down lagitimanetly make This the offical ADmin with all keys and things of that nature that make it the main one?
Thank you so much and I'll watch my jokes from now on... I don't want to hurt anyone's feelings,

PIX 501 passthrough with to a Win VPN Server

Can this piece of %^$ pix 501 allow port 1723 to be open so users can connect to a Windows VPN server configured by PDM?
pix 6.3(5)
Outside staic IP - whatever 111.111.111.111
Inside 192.168.1.1
Win VPN server 192.168.1.10
Thanks to anybody that can help.
Note - I wnat to know if thi can be accomplished using PDM 3.0.4
This pix has to have a use other than a glorified 4 port switch

Yes you can enable PIX501 with version 6.3.5 for PPTP pass through.
Command line:
static (inside,outside) tcp interface 1723 192.168.1.10 1723 netmask 255.255.255.255
fixup protocol pptp 1723
access-list permit tcp any host 111.111.111.111 eq 1723
If you don't already have an access-list applied to outside interface, then you also need the following:
access-group in interface outside
Then "clear xlate" after the above configuration. I also assume that you would like to use the outside interface ip address of the PIX for the translation. Otherwise, if 111.111.111.111 is actually a spare public ip address, then the above static command should say:
static (inside,outside) 111.111.111.111 192.168.1.10 netmask 255.255.255.255
Yes, it can be accomplished using PDM. But i have to apologize that i don't have a handy access to a PDM hence, i can only advise you on the configuration using CLI.
Hope that helps a little.

Problem with VPN by ASA 5505 and PIX 501

Hi
I have this scenario: Firewall ASA 5505, Firewall Pix 501 (with CatOS 6.3(5) ).
I have configured this appliance for Easy VPN (server is ASA) and PIX, and remote Access with Cisco client vpn (for internal lan ASA).
When i configure the ASA i have this problem, when i configure nat for easy vpn.
This is my nat configuration:
nat (inside) 0 access-list 100
nat (inside) 1 192.168.1.0 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0
nat (inside) 0 0.0.0.0 0.0.0.0 outside
when i put this command:
nat (inside) 0 access-list no-nat
this command is necessary for configuration of easy vpn, but the previous nat:
nat (inside) 0 access-list 100
is replace with the latest command.

To identify addresses on one interface that are translated to mapped addresses on another interface, use the nat command in global configuration mode. This command configures dynamic NAT or PAT, where an address is translated to one of a pool of mapped addresses. To remove the nat command, use the no form of this command.
For regular dynamic NAT:
nat (real_ifc) nat_id real_ip [mask [dns] [outside] [udp udp_max_conns] [norandomseq]]
no nat (real_ifc) nat_id real_ip [mask [dns] [outside] [udp udp_max_conns] [norandomseq]]
For policy dynamic NAT and NAT exemption:
nat (real_ifc) nat_id access-list access_list_name [dns] [outside] [udp udp_max_conns] [norandomseq]
no nat (real_ifc) nat_id access-list access_list_name [dns] [outside] [udp udp_max_conns] [norandomseq]

Trouble with PIX 501 user limit?

Similar Messages

Maybe you are looking for