sh tech Cisco PIX Firewall Version 6.3(5) Cisco PIX Device Manager Version 1.1(2) Compiled on Thu 04-Aug-05 21:40 by morlee fw01.hq up 4 days 1 hour Hardware: PIX-515, 32 MB RAM, CPU Pentium 200 MHz Flash i28F640J5 @ 0x300, 16MB BIOS Flash AT29C257 @ 0xfffd8000, 32KB 0: ethernet0: address is 0003.6bf6.d059, irq 11 1: ethernet1: address is 0003.6bf6.d05a, irq 10 Licensed Features: Failover: Enabled VPN-DES: Enabled VPN-3DES-AES: Enabled Maximum Physical Interfaces: 6 Maximum Interfaces: 10 Cut-through Proxy: Enabled Guards: Enabled URL-filtering: Enabled Inside Hosts: Unlimited Throughput: Unlimited IKE peers: Unlimited This PIX has an Unrestricted (UR) license. Serial Number: 405411551 (0x182a16df) Running Activation Key: 0xc67542dc 0x23d2d180 0x394ee79a 0x754e71ad Configuration last modified by enable_15 at 11:48:29.454 EDT Tue Oct 30 2007 ------------------ show clock ------------------ 10:17:43.272 EDT Wed Oct 31 2007 ------------------ show memory ------------------ Free memory: 14938496 bytes Used memory: 18615936 bytes ------------- ---------------- Total memory: 33554432 bytes ------------------ show conn count ------------------ 1389 in use, 1554 most used ------------------ show xlate count ------------------ 539 in use, 1033 most used ------------------ show blocks ------------------ SIZE MAX LOW CNT 4 1600 1593 1600 80 400 397 400 256 1524 1012 1524 1550 997 354 736 2560 200 150 198 ------------------ show interface ------------------ interface ethernet0 "outside" is up, line protocol is up Hardware is i82559 ethernet, address is 0003.6bf6.d059 IP address 216.223.62.17, subnet mask 255.255.255.224 MTU 1500 bytes, BW 100000 Kbit full duplex 21287462 packets input, 943768562 bytes, 0 no buffer Received 226913 broadcasts, 0 runts, 0 giants 49 input errors, 0 CRC, 0 frame, 49 overrun, 0 ignored, 0 abort 21929947 packets output, 3991782921 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (128/128) software (0/129) output queue (curr/max blocks): hardware (0/128) software (0/1) interface ethernet1 "inside" is up, line protocol is up Hardware is i82559 ethernet, address is 0003.6bf6.d05a IP address 10.9.8.1, subnet mask 255.255.0.0 MTU 1500 bytes, BW 100000 Kbit full duplex 29631300 packets input, 4274818456 bytes, 0 no buffer Received 7047694 broadcasts, 0 runts, 0 giants 59 input errors, 0 CRC, 0 frame, 59 overrun, 0 ignored, 0 abort 27459152 packets output, 2037684220 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (128/128) software (0/146) output queue (curr/max blocks): hardware (0/128) software (0/436) ------------------ show cpu usage ------------------ CPU utilization for 5 seconds = 8%; 1 minute: 7%; 5 minutes: 7% ------------------ show process ------------------ PC SP STATE Runtime SBASE Stack Process Hsi 001f02c9 008f806c 0056ed50 20 008f70e4 3592/4096 arp_timer Lsi 001f5a95 0099b264 0056ed50 10 0099a2ec 3800/4096 FragDBGC Lwe 0011a13f 009a7394 005724b8 60 009a652c 1792/4096 dbgtrace Lwe 003fb2fd 009a9524 00567688 1045280 009a75dc 6464/8192 Logger Hsi 003ff455 009ac61c 0056ed50 0 009aa6a4 8024/8192 tcp_fast Hsi 003ff2f5 009ae6cc 0056ed50 0 009ac754 7916/8192 tcp_slow Lsi 00314885 00ae4e4c 0056ed50 0 00ae3ec4 3916/4096 xlate clean Lsi 00314793 00ae5eec 0056ed50 0 00ae4f74 3548/4096 uxlate clean Mwe 0030be5f 00c862ec 0056ed50 10 00c84354 7744/8192 tcp_intercept_timer_process Lsi 00452ee5 00d32cc4 0056ed50 0 00d31d3c 3900/4096 route_process Hsi 002fb6fc 00d33d54 0056ed50 620 00d32dec 2388/4096 PIX Garbage Collector Hwe 0021e529 00d3e284 0056ed50 30 00d3a31c 13436/16384 isakmp_time_keeper Lsi 002f929c 00d5abe4 0056ed50 0 00d59c5c 3944/4096 perfmon Mwe 00214d39 00d85014 0056ed50 30 00d8309c 5264/8192 IPsec timer handler Hwe 003b105b 00d99424 00591c90 30 00d974dc 7048/8192 qos_metric_daemon Mwe 0026d0dd 00db3f7c 0056ed50 10 00db0014 13960/16384 IP Background Lwe 0030cad6 00e66c8c 00585368 170 00e65e14 1872/4096 pix/trace Lwe 0030cd0e 00e67d3c 00585a98 0 00e66ec4 3704/4096 pix/tconsole Hwe 0011fa67 00e71b3c 0051bc10 0 00e6e154 14508/16384 ci/console Hwe 0044c34a 00e7396c 005ebf78 10 00e72a34 3684/4096 lu_ctl Csi 003048fb 00e74a3c 0056ed50 50 00e73ae4 3296/4096 update_cpu_usage Hwe 002ef791 00f257e4 0054e100 0 00f2195c 15884/16384 uauth_in Hwe 003fdf05 00f278e4 0086f530 0 00f25a0c 7896/8192 uauth_thread Hwe 0041553a 00f28a34 00567c88 0 00f27abc 3960/4096 udp_timer Hsi 001e7d4e 00f2a6f4 0056ed50 0 00f2977c 3928/4096 557mcfix Crd 001e7d03 00f2b7b4 0056f1c8 211682050 00f2a82c 3580/4096 557poll Lsi 001e7dbd 00f2c854 0056ed50 0 00f2b8dc 2200/4096 557timer Cwe 001e99a9 00f4292c 00756ae0 2209210 00f40a34 5792/8192 pix/intf0 Mwe 004152aa 00f43a3c 008b9720 0 00f42b04 3896/4096 riprx/0 Msi 003ba8a1 00f44b4c 0056ed50 0 00f43bd4 3888/4096 riptx/0 Cwe 001e99a9 00f4ad54 007ce078 2187660 00f48e5c 5916/8192 pix/intf1 Mwe 004152aa 00f4be64 008b96d8 0 00f4af2c 3896/4096 riprx/1 Msi 003ba8a1 00f4cf74 0056ed50 0 00f4bffc 3888/4096 riptx/1 Hsi 0044d191 00f4f1d4 0056ed50 0 00f4e25c 3928/4096 lu_xmit_timer Hwe 0044be75 00f50274 0056b438 0 00f4f30c 3900/4096 lu_rx Hwe 001b6151 00f6eb84 005769d0 10 00f6dc1c 2828/4096 fover_thread Hwe 0011fa67 00f6f8dc 0051bc68 0 00f6ec34 3204/4096 fover_rx Hwe 001b8f91 00f70bc4 00577064 0 00f6fc4c 3960/4096 fover_tx Hwe 001b638c 00f72bdc 00577070 0 00f70c64 8056/8192 fover_rep Lwe 001b6549 00f73c04 00577078 0 00f72c7c 3976/4096 fover_lu_rep Hwe 001b95e2 00f77c0c 00577080 10 00f73c94 16052/16384 fover_parse Mwe 004152aa 00fe29cc 008b9690 10 00fe0bc4 5684/8192 radius_rcvauth Mwe 004152aa 00fe4b9c 008b9648 0 00fe2c74 7644/8192 radius_rcvacct Mwe 003b2a42 00fe6c9c 00561458 190 00fe4d24 6952/8192 radius_snd Hwe 00262f75 00ff39d4 0056ed50 40 00ff2a5c 3244/4096 ntp Hwe 004152aa 00ff4bd4 008b9600 300 00ff3cac 3000/4096 ntp0 Hwe 004152aa 00ff5704 008b9570 0 00ff4d5c 2356/4096 snmp Hwe 004152aa 00ff6314 008b95b8 0 00ff5fcc 812/1024 snmp_ex Hwe 003e4e45 00ff90f4 00ff95a4 15490 00ff72cc 4592/8192 isakmp_receiver Hwe 003fe199 00ffa8dc 00845cb8 0 00ffa294 1196/2048 listen/ssh_1 Mwe 0038707e 01002994 0056ed50 0 01000a1c 7960/8192 Crypto CA Mwe 003f7ded 010c4b74 0056ed50 0 010c2bfc 6424/8192 ssh/timer Hwe 003fe199 010d9c0c 00845ea8 0 010d95c4 1196/2048 listen/ssh_0 M* 003f101c 0009ff2c 0056ed88 760 011aec2c 11640/16384 ssh ------------------ show failover ------------------ Failover Off Cable status: My side not connected Reconnect timeout 0:00:00 Poll frequency 15 seconds ------------------ show traffic ------------------ outside: received (in 350418.790 secs): 21291062 packets 945710617 bytes 11 pkts/sec 2000 bytes/sec transmitted (in 350418.790 secs): 21933773 packets 3992362321 bytes 1 pkts/sec 11000 bytes/sec inside: received (in 350418.790 secs): 29635237 packets 4275376926 bytes 11 pkts/sec 12004 bytes/sec transmitted (in 350418.790 secs): 27464347 packets 2039878679 bytes 4 pkts/sec 5000 bytes/sec ------------------ show perfmon ------------------ PERFMON STATS: Current Average Xlates 11/s 2/s Connections 26/s 8/s TCP Conns 11/s 2/s UDP Conns 15/s 5/s URL Access 1/s 0/s URL Server Req 0/s 0/s TCP Fixup 301/s 10/s TCPIntercept 0/s 0/s HTTP Fixup 94/s 1/s FTP Fixup 0/s 0/s AAA Authen 0/s 0/s AAA Author 0/s 0/s AAA Account 0/s 0/s ------------------ show running-config ------------------ : Saved : PIX Version 6.3(5) interface ethernet0 100full interface ethernet1 100full nameif ethernet0 outside security0 nameif ethernet1 inside security100 hostname fw01.hq domain-name themunicenter.com clock timezone EDT -5 fixup protocol dns maximum-length 512 fixup protocol ftp 21 fixup protocol h323 h225 1720 fixup protocol h323 ras 1718-1719 fixup protocol http 80 fixup protocol rsh 514 fixup protocol rtsp 554 no fixup protocol sip 5060 no fixup protocol sip udp 5060 fixup protocol skinny 2000 fixup protocol smtp 25 fixup protocol sqlnet 1521 fixup protocol tftp 69 no names name 10.10.20.0 Network_TMCStage name 10.10.60.0 Network_TMCSecaucus name 10.9.8.243 INT_Spamdarmad object-group service SVC_Mail_TCP tcp port-object eq ssh port-object eq https object-group service SVC_Hobbes_TCP tcp port-object eq https port-object eq 993 port-object eq 3268 object-group service SVC_Devweb_TCP tcp port-object eq https port-object eq 4242 object-group icmp-type SVC_ICMP icmp-object echo icmp-object echo-reply icmp-object unreachable icmp-object parameter-problem icmp-object time-exceeded icmp-object traceroute object-group service Local_SVC tcp port-object eq domain port-object eq pop3 port-object eq imap4 port-object eq ssh port-object eq telnet port-object eq smtp port-object eq www port-object eq 123 port-object eq https port-object eq ftp port-object eq ftp-data port-object eq aol port-object eq 4000 object-group service SVC_Restricted_Mail_TCP tcp port-object eq smtp access-list INTERNET permit ip any 10.9.0.0 255.255.0.0 access-list INTERNET permit tcp any host 216.57.44.211 object-group SVC_Hobbes_TCP access-list INTERNET permit tcp any host 216.57.44.213 object-group SVC_Devweb_TCP access-list INTERNET permit tcp any 10.9.0.0 255.255.0.0 access-list INTERNET permit udp any 10.9.0.0 255.255.0.0 access-list INTERNET permit icmp any any object-group SVC_ICMP access-list INTERNET permit tcp 64.18.0.0 255.255.240.0 host 216.57.44.210 object-group SVC_Restricted_Mail_TCP access-list INTERNET permit tcp 207.126.144.0 255.255.240.0 host 216.57.44.210 object-group SVC_Restricted_Mail_TCP access-list INTERNET permit tcp any host 216.57.44.210 object-group SVC_Mail_TCP access-list INTERNET permit tcp 209.10.150.64 255.255.255.224 host 216.57.44.211 eq 995 access-list INTERNET permit ip 10.9.0.0 255.255.0.0 10.10.30.0 255.255.255.0 access-list INTERNET permit ip 10.9.0.0 255.255.0.0 10.10.20.0 255.255.255.0 access-list LAN permit icmp any any access-list LAN deny tcp any any eq 1214 access-list LAN deny udp any any eq 1214 access-list LAN deny ip 209.61.186.0 255.255.255.0 any access-list LAN deny ip 64.49.201.0 255.255.255.0 any access-list LAN deny tcp any any range 41000 42000 access-list LAN deny udp any any range 41000 42000 access-list LAN deny ip 64.245.58.0 255.255.254.0 any access-list LAN deny ip 209.25.178.0 255.255.255.0 any access-list LAN deny ip 64.124.41.0 255.255.255.0 any access-list LAN deny tcp any any eq 6699 access-list LAN deny ip 216.35.208.0 255.255.255.0 any access-list LAN deny tcp any any range 6345 6349 access-list LAN deny udp any any range 6345 6349 access-list LAN permit tcp any any eq domain access-list LAN permit udp any any eq domain access-list LAN permit tcp any any eq pop3 access-list LAN permit tcp any any eq imap4 access-list LAN permit tcp any any eq ssh access-list LAN permit tcp any any eq telnet access-list LAN permit tcp any any eq smtp access-list LAN permit tcp any any eq www access-list LAN permit tcp any any eq 123 access-list LAN permit tcp any any eq https access-list LAN permit tcp any any eq ftp access-list LAN permit tcp any any eq ftp-data access-list LAN permit tcp any any eq 4000 access-list LAN permit tcp any any eq aol access-list LAN permit ip any any access-list RMTCLI permit ip 10.9.0.0 255.255.0.0 10.9.14.0 255.255.255.0 access-list RMTCLI permit ip 10.10.20.0 255.255.255.0 10.9.0.0 255.255.0.0 access-list RMTCLI permit ip 10.10.30.0 255.255.255.0 10.9.0.0 255.255.0.0 access-list RMTCLI permit ip 10.10.60.0 255.255.255.0 10.9.0.0 255.255.0.0 access-list RMTCLI permit ip 10.9.0.0 255.255.0.0 10.10.20.0 255.255.255.0 access-list RMTCLI permit ip 10.9.0.0 255.255.0.0 10.10.30.0 255.255.255.0 access-list RMTCLI permit ip 10.9.0.0 255.255.0.0 10.10.60.0 255.255.255.0 access-list INTERNAP permit ip any 10.9.0.0 255.255.0.0 access-list INTERNAP permit tcp any host 216.223.62.15 object-group SVC_Hobbes_TCP access-list INTERNAP permit tcp any 10.9.0.0 255.255.0.0 access-list INTERNAP permit udp any 10.9.0.0 255.255.0.0 access-list INTERNAP permit icmp any any object-group SVC_ICMP access-list INTERNAP permit tcp 64.18.0.0 255.255.240.0 host 216.223.62.16 object-group SVC_Restricted_Mail_TCP access-list INTERNAP permit tcp 207.126.144.0 255.255.240.0 host 216.223.62.16 object-group SVC_Restricted_Mail_TCP access-list INTERNAP permit tcp 209.10.150.64 255.255.255.224 host 216.223.62.15 eq 995 access-list INTERNAP permit tcp any host 216.223.62.16 eq ssh log access-list OUTBOUND permit ip any any access-list 540_TO_601 permit ip 10.9.0.0 255.255.0.0 10.10.30.0 255.255.255.0 log access-list 540_TO_601 permit ip 10.9.0.0 255.255.0.0 10.10.20.0 255.255.255.0 log access-list 540_TO_601 permit ip host 67.56.48.194 10.10.20.0 255.255.255.0 log access-list 540_TO_601 permit ip host 169.193.108.89 10.10.20.0 255.255.255.0 log access-list noNAT permit ip 10.9.0.0 255.255.0.0 10.10.30.0 255.255.255.0 log access-list noNAT permit ip 10.9.0.0 255.255.0.0 10.10.20.0 255.255.255.0 log access-list noNAT permit ip host 169.193.108.89 10.10.20.0 255.255.255.0 log access-list noNAT permit ip host 67.56.48.194 10.10.20.0 255.255.255.0 log pager lines 30 logging on logging timestamp logging trap debugging logging facility 23 logging host inside 10.9.8.244 mtu outside 1500 mtu inside 1500 ip address outside 216.223.62.17 255.255.255.224 ip address inside 10.9.8.1 255.255.0.0 ip audit info action alarm ip audit attack action alarm ip local pool VPNpool 10.9.14.10-10.9.14.100 no failover failover timeout 0:00:00 failover poll 15 no failover ip address outside no failover ip address inside pdm history enable arp timeout 14400 global (outside) 1 interface global (outside) 2 216.223.62.16 netmask 255.255.255.255 nat (inside) 0 access-list noNAT nat (inside) 2 10.9.8.244 255.255.255.255 0 0 nat (inside) 1 10.9.0.0 255.255.0.0 0 0 static (inside,outside) tcp 216.223.62.16 https 10.9.8.244 https netmask 255.255.255.255 0 0 static (inside,outside) tcp 216.223.62.16 smtp 10.9.8.244 smtp netmask 255.255.255.255 0 0 static (inside,outside) tcp 216.223.62.16 ssh 10.9.8.238 ssh netmask 255.255.255.255 0 0 static (inside,outside) 216.223.62.15 10.9.8.246 netmask 255.255.255.255 0 0 access-group INTERNAP in interface outside access-group LAN in interface inside conduit permit icmp any any route outside 0.0.0.0 0.0.0.0 216.223.62.1 1 route inside 67.56.48.194 255.255.255.255 10.9.8.10 1 route inside 169.193.108.89 255.255.255.255 10.9.8.10 1 timeout conn 1:00:00 half-closed 1:00:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00 timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout sip-disconnect 0:02:00 sip-invite 0:03:00 timeout uauth 0:01:00 absolute timeout xlate 0:01:00 aaa-server TACACS+ protocol tacacs+ aaa-server TACACS+ max-failed-attempts 3 aaa-server TACACS+ deadtime 10 aaa-server RADIUS protocol radius aaa-server RADIUS max-failed-attempts 3 aaa-server RADIUS deadtime 10 aaa-server LOCAL protocol local aaa-server PDC protocol radius aaa-server PDC max-failed-attempts 3 aaa-server PDC deadtime 10 aaa-server PDC (inside) host 10.9.8.247 l8n!&ht timeout 10 aaa-server VPNCLNAUTH protocol radius aaa-server VPNCLNAUTH max-failed-attempts 3 aaa-server VPNCLNAUTH deadtime 10 aaa-server VPNCLNAUTH (inside) host 10.9.8.246 l8n!&ht timeout 10 ntp server 207.46.130.100 source outside snmp-server host inside 10.9.8.244 snmp-server location 540 Madison snmp-server contact sysadmin snmp-server community Retnec1nuM snmp-server enable traps tftp-server inside 10.9.8.244 fw01hq.conf no floodguard enable sysopt connection permit-ipsec sysopt connection permit-l2tp crypto ipsec transform-set normal-des esp-des esp-md5-hmac crypto ipsec transform-set strong-3des esp-3des esp-md5-hmac crypto ipsec transform-set strong esp-3des esp-sha-hmac crypto ipsec transform-set weak esp-des esp-md5-hmac crypto dynamic-map RMT1 5 set transform-set strong-3des crypto map RMT 1 ipsec-isakmp crypto map RMT 1 match address 540_TO_601 crypto map RMT 1 set peer 64.61.73.193 crypto map RMT 1 set transform-set strong crypto map RMT 1 set security-association lifetime seconds 28800 kilobytes 46000000 crypto map RMT 10 ipsec-isakmp dynamic RMT1 crypto map RMT client configuration address respond crypto map RMT client authentication VPNCLNAUTH crypto map RMT interface outside isakmp enable outside isakmp key ******** address 64.61.73.193 netmask 255.255.255.255 isakmp identity address isakmp nat-traversal 20 isakmp policy 1 authentication pre-share isakmp policy 1 encryption 3des isakmp policy 1 hash md5 isakmp policy 1 group 2 isakmp policy 1 lifetime 86400 isakmp policy 2 authentication pre-share isakmp policy 2 encryption 3des isakmp policy 2 hash sha isakmp policy 2 group 1 isakmp policy 2 lifetime 86400 isakmp policy 3 authentication pre-share isakmp policy 3 encryption 3des isakmp policy 3 hash sha isakmp policy 3 group 2 isakmp policy 3 lifetime 64800 isakmp policy 4 authentication pre-share isakmp policy 4 encryption 3des isakmp policy 4 hash md5 isakmp policy 4 group 2 isakmp policy 4 lifetime 28800 isakmp policy 5 authentication pre-share isakmp policy 5 encryption 3des isakmp policy 5 hash sha isakmp policy 5 group 2 isakmp policy 5 lifetime 28800 isakmp policy 6 authentication pre-share isakmp policy 6 encryption 3des isakmp policy 6 hash sha isakmp policy 6 group 2 isakmp policy 6 lifetime 86400 isakmp policy 8 authentication pre-share isakmp policy 8 encryption des isakmp policy 8 hash sha isakmp policy 8 group 2 isakmp policy 8 lifetime 86400 isakmp policy 9 authentication pre-share isakmp policy 9 encryption des isakmp policy 9 hash md5 isakmp policy 9 group 2 isakmp policy 9 lifetime 86400 vpngroup clivpn address-pool VPNpool vpngroup clivpn dns-server 10.9.8.246 vpngroup clivpn default-domain hq.themunicenter.com vpngroup clivpn split-tunnel RMTCLI vpngroup clivpn idle-time 18000 vpngroup clivpn password ******** vpngroup clivp idle-time 1800 telnet timeout 5 ssh 171.68.225.213 255.255.255.255 outside ssh 10.9.8.154 255.255.255.255 inside ssh 10.9.8.173 255.255.255.255 inside ssh timeout 60 management-access inside console timeout 0 terminal width 80 Cryptochecksum:7ad6139e85c03c5251360453ea864225