Cisco 851 firewall woes

Cisco 851 firewall woes
NewsGroups | Search | Tools
User Password
Register Now! Lost Password?
 comp.dcom.sys.cisco  Post an article  get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content  add this group's latest topics to your Google content  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Cisco 851 firewall woes vorpus 05-05-2008
Posted by on May 5, 2008, 8:28 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I'm having a massive problem with my Cisco 851. I'm brand new to Cisco
and the IOS and will actually be attending some technical training in
the coming days. In the meantime, though, I am unable to use the built-
in firewall.

Using the SDM, here is the error I get when using the basic firewall
wizard:

-----------------------------------------------
Submitting 99 commands, please wait...
class-map type inspect match-any sdm-cls-insp-traffic


Error detected at this command. Click OK
-----------------------------------------------

When I connect to the router via the console, this is what it tells
me:

-----------------------------------------------
vorpalrouter#conf t
Enter configuration commands, one per line. End with CNTL/Z.
vorpalrouter(config)#class-map ?
% Unrecognized command
vorpalrouter(config)#class-map
-----------------------------------------------

Any idea why this is happening? Is there any other way I can lock down
ports?

Pure Networks
Posted by Peter on May 6, 2008, 3:42 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Greetings,

> When I connect to the router via the console, this is what it tells
> me:
>
> -----------------------------------------------
> vorpalrouter#conf t
> Enter configuration commands, one per line. End with CNTL/Z.
> vorpalrouter(config)#class-map ?
> % Unrecognized command
> vorpalrouter(config)#class-map
> -----------------------------------------------
>
> Any idea why this is happening?

Without more info its hard to say exactly, but the error message
suggests to me that the version of IOS you are using does not include
that command (and that command is not firewall specific).

Using the CLI, post the output of the "sh ver" command. This will tell
us the H/W and S/W details of what is in your Router.

> Is there any other way I can lock down ports?

If you really do have the Firewall IOS (which I doubt, we need to see
the the above output to be able to tell), then by default everything
already IS shut down.

Cheers.......................pk.


--
Peter from Auckland.

Posted by on May 6, 2008, 1:20 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Greetings,
>
> > When I connect to the router via the console, this is what it tells
> > me:
>
> > -----------------------------------------------
> > vorpalrouter#conf t
> > Enter configuration commands, one per line. =A0End with CNTL/Z.
> > vorpalrouter(config)#class-map ?
> > % Unrecognized command
> > vorpalrouter(config)#class-map
> > -----------------------------------------------
>
> > Any idea why this is happening?
>
> Without more info its hard to say exactly, but the error message
> suggests to me that the version of IOS you are using does not include
> that command (and that command is not firewall specific).
>
> Using the CLI, post the output of the "sh ver" command. This will tell
> us the H/W and S/W details of what is in your Router.
>
> > Is there any other way I can lock down ports?
>
> If you really do have the Firewall IOS (which I doubt, we need to see
> the the above output to be able to tell), then by default everything
> already IS shut down.

Hmmm. Not shut down in my experience.
But then I usually blow away the SDM default
anyway.

You need the following.

Deny EVERYTHING inbound
Use inspect to allow "returning traffic" back in.
Of course you can then add exceptions to the
inbound block as required if you were publishing serviices
to the internet.

ip inspect name sunshine tcp
ip inspect name sunshine udp
ip inspect name sunshine icmp

!! Add the following if you require/want:-
ip inspect name sunshine ftp
ip inspect name sunshine http
ip inspect name sunshine tftp
ip inspect name sunshine netshow
ip inspect name sunshine realaudio
ip inspect name sunshine sip
ip inspect name sunshine skinny

ip inspect name sunshine rtsp
ip inspect name sunshine streamworks





interface ATM0/0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0/0.1 point-to-point
pvc 0/38
encapsulation aal5mux ppp dialer
dialer pool-member 1

interface Dialer0
ip address <removed>
ip access-group inbound in
ip inspect sunshine out

ip access-list extended inbound
deny ip any any





Posted by Uli Link on May 6, 2008, 4:06 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Peter schrieb:
> Without more info its hard to say exactly, but the error message
> suggests to me that the version of IOS you are using does not include
> that command (and that command is not firewall specific).
>
The 850 series routers only comes with advsecurity IOS (which includes
the Firewall featureset)

--
Uli

Posted by Charles N Wyble on June 3, 2008, 3:20 am
If you were  Registered and logged in, you could reply and use other advanced thread options
What feature packs? What version?

class-map ? works for me.

Cisco 1841 running

Cisco IOS Software, 1841 Software (C1841-IPBASE-M), Version 12.3(8)T4,
RELEASE SOFTWARE (fc2)

<host>(config)#class-map ?
WORD class-map name
match-all Logical-AND all matching statements under this classmap
match-any Logical-OR all matching statements under this classmap

I'm not an expert on the different cisco lines so maybe the 851 doesn't
support what you want?

You should check the release notes and feature matrix for your router.

Charles



vorpus@gmail.com wrote:
> I'm having a massive problem with my Cisco 851. I'm brand new to Cisco
> and the IOS and will actually be attending some technical training in
> the coming days. In the meantime, though, I am unable to use the built-
> in firewall.
>
> Using the SDM, here is the error I get when using the basic firewall
> wizard:
>
> -----------------------------------------------
> Submitting 99 commands, please wait...
> class-map type inspect match-any sdm-cls-insp-traffic
>
>
> Error detected at this command. Click OK
> -----------------------------------------------
>
> When I connect to the router via the console, this is what it tells
> me:
>
> -----------------------------------------------
> vorpalrouter#conf t
> Enter configuration commands, one per line. End with CNTL/Z.
> vorpalrouter(config)#class-map ?
> % Unrecognized command
> vorpalrouter(config)#class-map
> -----------------------------------------------
>
> Any idea why this is happening? Is there any other way I can lock down
> ports?

Similar ThreadsPosted
Cisco 7912 IP Phone PoE woes August 9, 2006, 10:32 am
Cisco PIX woes with MS Cert Service on Windows 2000 August 25, 2006, 7:09 am
Connecting to a PIX firewall using cisco VPM client though a Linksys WAG54G with eth firewall enabled December 11, 2004, 5:16 pm
PDM woes (yet another...) February 2, 2005, 12:25 am
Dynamic DNS woes January 7, 2006, 1:11 pm
Multicast woes January 30, 2006, 4:18 pm
AAA authentication woes April 27, 2006, 6:22 am
E-Mail Woes to Mailsweeper on PIX DMZ October 13, 2006, 2:53 pm
2801 power supply woes... December 6, 2006, 6:56 am
AP1310, adding a new one to an existing setup woes May 30, 2006, 5:51 am

other useful resources:
The Federal Communications Commission (FCC)
Telecommunications Industry Association
Electronic and Software Security Products and Services
International Telecommunication Union

Custom CGI Perl and PHP programming by 1-Script.com

Contact Us | Privacy Policy
The site map in XML format XML site map