Segurança : Dispositivos de segurança Cisco PIX 500 Series

Monitorando o Cisco Secure PIX Firewall usando o SNMP e Syslog através do túnel VPN

19 Setembro 2015 - Tradução por Computador
Outras Versões: Versão em PDFpdf | Inglês (22 Agosto 2015) | Feedback


Índice


Introdução

Os firewalls Cisco Secure PIX geralmente são usados em implementações de VPN de site a site em que os PIXes são usados como dispositivos de terminação de VPN IPSec. Em projetos de site a site simples ou de hub e spoke mais complicados, as pessoas, às vezes, querem monitorar todos os firewalls PIX usando o servidor do Simple Network Management Protocol (SNMP) e o servidor de syslog localizados em uma instalação central.

Nota: A fim configurar PIX 7.x usando o SNMP e o Syslog com um VPN escave um túnel, refira PIX/ASA 7.x com exemplo de configuração do Syslog.

Pré-requisitos

Requisitos

Não existem requisitos específicos para este documento.

Componentes Utilizados

As informações neste documento são baseadas nestas versões de software e hardware:

  • Liberação de Software do firewall Cisco PIX 6.3(3)

  • PIX Firewall 520 e 515

  • Um sistema Solaris que execute o HPOV.6.1 como um SNMP e um servidor de SYSLOG

As informações neste documento foram criadas a partir de dispositivos em um ambiente de laboratório específico. Todos os dispositivos utilizados neste documento foram iniciados com uma configuração (padrão) inicial. Se a sua rede estiver ativa, certifique-se de que entende o impacto potencial de qualquer comando.

Convenções

Consulte as Convenções de Dicas Técnicas da Cisco para obter mais informações sobre convenções de documentos.

Informações de Apoio

Refira a utilização do SNMP com o firewall PIX segura Cisco para obter informações gerais sobre de como usar o SNMP para monitorar o firewall PIX segura Cisco.

Refira estabelecer o Syslog PIX para obter informações gerais sobre de como setup o Syslog no firewall PIX segura Cisco.

Estes são os objetivos para esta configuração de exemplo:

  • Tenha dados entre as redes 10.99.99.x e 172.18.124.x cifradas. Isto inclui syslog e SNMP entre a rede 10.99.99.x e o servidor de SNMP/syslog 172.18.124.112.

  • A capacidade para mandar ambas as PIXes enviar o Syslog ao server do SNMP/syslog.

  • A capacidade para fazer perguntas SNMP a e para enviar armadilhas de ambas as PIXes ao server do SNMP/syslog.

Configurar

Esta configuração de exemplo demonstra como monitorar um firewall PIX segura Cisco usando o SNMP e o Syslog através dos túneis existentes VPN.

Diagrama de Rede

Este documento utiliza a seguinte configuração de rede:

http://www.cisco.com/c/dam/en/us/support/docs/security/pix-500-series-security-appliances/4094-pix-vpn-4094a-1.gif

Configurações

Este documento utiliza as seguintes configurações:

Firewall de PIX local (PIX 520)
PIX Version 6.3(3)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security10
nameif ethernet3 intf3 security15
nameif ethernet4 intf4 security20
nameif ethernet5 intf5 security25
enable password OnTrBUG1Tp0edmkr encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pix-520b
domain-name cisco.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names

!--- This access control list (ACL) defines IPsec interesting traffic.
!--- This line covers traffic between the LAN segment behind two PIXes.
!--- It also includes the SNMP/syslog traffic between the SNMP/syslog server
!--- and the network devices located on the Ethernet segment behind the PIX 515.

access-list 101 permit ip 172.18.124.0 255.255.255.0 10.99.99.0 255.255.255.0

!--- These lines cover SNMP (TCP/UDP port - 161), SNMP TRAPS(TCP/UDP port - 162) and 
!--- syslog traffic (UDP port - 514) from SNMP/syslog server to the 
!--- outside interface of the remote PIX.
 
access-list 101 permit tcp host 172.18.124.112 host 192.168.1.2 eq 161
access-list 101 permit udp host 172.18.124.112 host 192.168.1.2 eq 161
access-list 101 permit tcp host 172.18.124.112 host 192.168.1.2 eq 162
access-list 101 permit udp host 172.18.124.112 host 192.168.1.2 eq 162
access-list 101 permit udp host 172.18.124.112 host 192.168.1.2 eq 514
pager lines 24
logging on
logging trap debugging
logging history debugging

!--- Define logging host information.

logging facility 16
logging host inside 172.18.124.112
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
interface ethernet3 auto shutdown
interface ethernet4 auto shutdown
interface ethernet5 auto shutdown
mtu outside 1500
mtu inside 1500
mtu intf2 1500
mtu intf3 1500
mtu intf4 1500
mtu intf5 1500
ip address outside 192.168.1.1 255.255.255.0
ip address inside 172.18.124.211 255.255.255.0
ip address intf2 127.0.0.1 255.255.255.255
ip address intf3 127.0.0.1 255.255.255.255
ip address intf4 127.0.0.1 255.255.255.255
ip address intf5 127.0.0.1 255.255.255.255
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address intf2 0.0.0.0
failover ip address intf3 0.0.0.0
failover ip address intf4 0.0.0.0
failover ip address intf5 0.0.0.0
pdm history enable
arp timeout 14400
global (outside) 1 192.168.1.4

!--- Bypass NAT for IPsec traffic.

nat (inside) 0 access-list 101
conduit permit udp any any 
conduit permit tcp any any 
conduit permit icmp any any 
route outside 0.0.0.0 0.0.0.0 192.168.1.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 
0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server RADIUS protocol radius
http server enable
http 172.18.124.112 255.255.255.255 inside

!--- Define SNMP configuration.

snmp-server host inside 172.18.124.112
no snmp-server location
no snmp-server contact
snmp-server community test
snmp-server enable traps
floodguard enable

!--- IPsec configuration. 

sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set myset esp-des esp-md5-hmac 
crypto map vpn 10 ipsec-isakmp
crypto map vpn 10 match address 101
crypto map vpn 10 set peer 192.168.1.2
crypto map vpn 10 set transform-set myset
crypto map vpn interface outside
isakmp enable outside
isakmp key ******** address 192.168.1.2 netmask 255.255.255.255 
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 1
isakmp policy 1 lifetime 86400
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:03b5bc406e18006616ffbaa32caeccd1
: end

Firewall PIX Remoto (PIX 515)
PIX Version 6.3(3)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security10
nameif ethernet3 intf3 security15
nameif ethernet4 intf4 security20
nameif ethernet5 intf5 security25
enable password OnTrBUG1Tp0edmkr encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname PIX515A
domain-name cisco.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names

!--- This ACL defines IPsec interesting traffic.
!--- This line covers traffic between the LAN segment behind two PIXes.
!--- It also covers the SNMP/syslog traffic between the SNMP/syslog server
!--- and the network devices located on the Ethernet segment behind PIX 515.

access-list 101 permit ip 10.99.99.0 255.255.255.0 172.18.124.0 255.255.255.0

 
!--- These lines cover SNMP (TCP/UDP port - 161), SNMP TRAPS (TCP/UDP port - 162) and 
!--- syslog traffic (UDP port - 514) sent from this PIX outside interface 
!--- to the SYSLOG server.

access-list 101 permit tcp host 192.168.1.2 host 172.18.124.112 eq 161 
access-list 101 permit udp host 192.168.1.2 host 172.18.124.112 eq 161
access-list 101 permit tcp host 192.168.1.2 host 172.18.124.112 eq 162
access-list 101 permit udp host 192.168.1.2 host 172.18.124.112 eq 162
access-list 101 permit udp host 192.168.1.2 host 172.18.124.112 eq 514

pager lines 24
logging on
logging timestamp
logging monitor debugging
logging trap debugging
logging history debugging

!--- Define syslog server.

logging facility 23
logging host outside 172.18.124.112
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
interface ethernet3 auto shutdown
interface ethernet4 auto shutdown
interface ethernet5 auto shutdown
mtu outside 1500
mtu inside 1500
mtu intf2 1500
mtu intf3 1500
mtu intf4 1500
mtu intf5 1500
ip address outside 192.168.1.2 255.255.255.0
ip address inside 10.99.99.1 255.255.255.0
ip address intf2 127.0.0.1 255.255.255.255
ip address intf3 127.0.0.1 255.255.255.255
ip address intf4 127.0.0.1 255.255.255.255
ip address intf5 127.0.0.1 255.255.255.255
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address intf2 0.0.0.0
failover ip address intf3 0.0.0.0
failover ip address intf4 0.0.0.0
failover ip address intf5 0.0.0.0
pdm history enable
arp timeout 14400
global (outside) 1 192.168.1.3

!--- Bypass NAT for IPsec traffic.

nat (inside) 0 access-list 101
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 
0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+ 
aaa-server RADIUS protocol radius 
http server enable
http 10.99.99.99 255.255.255.255 inside

!--- Define SNMP server.

snmp-server host outside 172.18.124.112
no snmp-server location
no snmp-server contact
snmp-server community test
snmp-server enable traps
floodguard enable

!--- IPsec configuration.

sysopt connection permit-ipsec
no sysopt route dnat
crypto ipsec transform-set myset esp-des esp-md5-hmac 
crypto map vpn 10 ipsec-isakmp
crypto map vpn 10 match address 101
crypto map vpn 10 set peer 192.168.1.1
crypto map vpn 10 set transform-set myset
crypto map vpn interface outside
isakmp enable outside
isakmp key ******** address 192.168.1.1 netmask 255.255.255.255 
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 1
isakmp policy 1 lifetime 86400
telnet timeout 5
ssh timeout 5
terminal width 80
Cryptochecksum:edb21b64ab79eeb6eaf99746c94a1e36
: end

Informações sobre a configuração do servidor de SNMP e syslog

O HPOV.6.1 é usado como o aplicativo de servidor SNMP.

Para coleção de syslog, o syslog daemon (syslogd) é usado, e as informações de syslog do PIX local e do PIX remoto são armazenadas em arquivos diferentes com base no recurso de registro configurado no PIX Firewall.

O arquivo de /etc/syslog.conf tem:

local0.debug /var/log/local.log 
local7.debug /var/log/remote.log 

Na configuração do PIX local, o logging facility 16 corresponde ao LOCAL0.

Na configuração do PIX remoto, o logging facility 23 corresponde ao LOCAL7.

Verificar

Use esta seção para confirmar se a sua configuração funciona corretamente.

A Output Interpreter Tool (apenas para clientes registrados) (OIT) suporta determinados comandos show. Use a OIT para exibir uma análise da saída do comando show.

Nota: Os comandos clear devem ser executados no modo config.

  • clear crypto ipsec sa — Restaura as associações IPsec depois que falhas de tentativa negociar um túnel VPN.

  • clear crypto isakmp sa — Restaura as associações de segurança do Internet Security Association and Key Management Protocol (ISAKMP) depois que falhas de tentativa negociar um túnel VPN.

  • show crypto engine ipsec — Indica as sessões de criptografia.

Troubleshooting

Comandos para Troubleshooting

A Output Interpreter Tool (apenas para clientes registrados) (OIT) suporta determinados comandos show. Use a OIT para exibir uma análise da saída do comando show.

Nota: Consulte Informações Importantes sobre Comandos de Depuração antes de usar comandos debug.

  • IPsec do debug crypto — Usado para ver se um cliente negocia a parte IPSec da conexão de VPN.

  • isakmp do debug crypto — Usado para ver se os pares negociam a parcela ISAKMP da conexão de VPN.

Exemplo de debug

Saída de SNMP

Estes exemplos demonstram como usar o snmpwalk a fim monitorar a utilização do buffer de ambos os Firewall PIX. O Identificador de Objeto (OID) para o status do buffer é:

"cfwBufferStatsTable"     "1.3.6.1.4.1.9.9.147.1.2.2.1"
  • Monitore o Firewall do PIX remoto:

    Script started on Tue Oct 09 21:53:54 2001
    # ./snmpwalk -c test 192.168.1.2 1.3.6.1.4.1.9.9.147.1.2.2.1
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.4.3 : OCTET STRING- (ascii):  
    maximum number of allocated 4 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.
    cfwSystem.cfwStatistics.cfwBufferStatsTable.
    cfwBufferStatsEntry.cfwBufferStatInformation.4.5 : 
    OCTET STRING- (ascii):  fewest 4 byte blocks available since 
    system startup
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.
    cfwSystem.cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.4.8 : OCTET STRING- (ascii):  
    current number of available 4 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.
    cfwSystem.cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.80.3 : OCTET STRING- (ascii): 
    maximum number of allocated 80 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.
    cfwSystem.cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.80.5 : OCTET STRING- (ascii): 
    fewest 80 byte blocks available since system startup
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.
    cfwSystem.cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.80.8 : OCTET STRING- (ascii): 
    current number of available 80 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.
    cfwSystem.cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.256.3 : OCTET STRING- (ascii):        
    maximum number of allocated 256 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.
    cfwSystem.cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.256.5 : OCTET STRING- (ascii):        
    fewest 256 byte blocks available since system startup
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.
    cfwSystem.cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.256.8 : OCTET STRING- (ascii):        
    current number of available 256 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.
    cfwSystem.cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.1550.3 : OCTET STRING- (ascii):       
    maximum number of allocated 1550 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.
    cfwSystem.cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.1550.5 : OCTET STRING- (ascii):       
    fewest 1550 byte blocks available since system startup
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.1550.8 : OCTET STRING- (ascii):       
    current number of available 1550 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.2560.3 : OCTET STRING- (ascii):      
    maximum number of allocated 2560 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.2560.5 : OCTET STRING- (ascii):       
    fewest 2560 byte blocks available since system startup
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.2560.8 : OCTET STRING- (ascii):       
    current number of available 2560 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.4.3 : Gauge32: 1600
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.4.5 : Gauge32: 1599
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.4.8 : Gauge32: 1600
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.80.3 : Gauge32: 400
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.80.5 : Gauge32: 399
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.80.8 : Gauge32: 400
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.256.3 : Gauge32: 750
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.256.5 : Gauge32: 746
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.256.8 : Gauge32: 749
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.1550.3 : Gauge32: 1956
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.1550.5 : Gauge32: 1166
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.1550.8 : Gauge32: 1188
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.2560.3 : Gauge32: 200
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.2560.5 : Gauge32: 196
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.2560.8 : Gauge32: 199
  • Monitore o firewall de PIX local:

    Script started on Tue Oct 09 21:54:53 2001
    # ./snmpwalk -c test 172.18.124.211  1.3.6.1.4.1.9.9.147.1.2.2.1
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.4.3 : OCTET STRING- (ascii):  
    maximum number of allocated 4 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.4.5 : OCTET STRING- (ascii):  
    fewest 4 byte blocks available since system startup
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.4.8 : OCTET STRING- (ascii):  
    current number of available 4 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.80.3 : OCTET STRING- (ascii): 
    maximum number of allocated 80 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.80.5 : OCTET STRING- (ascii): 
    fewest 80 byte blocks available since system startup
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.80.8 : OCTET STRING- (ascii): 
    current number of available 80 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.256.3 : OCTET STRING- (ascii):        
    maximum number of allocated 256 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.256.5 : OCTET STRING- (ascii):        
    fewest 256 byte blocks available since system startup
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.256.8 : OCTET STRING- (ascii):        
    current number of available 256 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.1550.3 : OCTET STRING- (ascii):       
    maximum number of allocated 1550 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.1550.5 : OCTET STRING- (ascii):       
    fewest 1550 byte blocks available since system startup
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.1550.8 : OCTET STRING- (ascii):       
    current number of available 1550 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.2560.3 : OCTET STRING- (ascii):       
    maximum number of allocated 2560 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.2560.5 : OCTET STRING- (ascii):       
    fewest 2560 byte blocks available since system startup
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatInformation.2560.8 : OCTET STRING- (ascii):       
    current number of available 2560 byte blocks
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.4.3 : Gauge32: 1600
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.4.5 : Gauge32: 1599
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.4.8 : Gauge32: 1600
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.80.3 : Gauge32: 400
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.80.5 : Gauge32: 397
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.80.8 : Gauge32: 400
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.256.3 : Gauge32: 1500
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.256.5 : Gauge32: 1497
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.256.8 : Gauge32: 1499
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.1550.3 : Gauge32: 2468
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.1550.5 : Gauge32: 1686
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.1550.8 : Gauge32: 1700
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.2560.3 : Gauge32: 200
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.2560.5 : Gauge32: 198
    cisco.ciscoMgmt.ciscoFirewallMIB.ciscoFirewallMIBObjects.cfwSystem.
    cfwStatistics.cfwBufferStatsTable.cfwBufferStatsEntry.
    cfwBufferStatValue.2560.8 : Gauge32: 199

O comando show block

A saída do snmpwalk da tabela de estatísticas de buffer CFW corresponde a este comando show no PIX remoto.

PIX-515A#show block
TAMANHO MAX BAIXO CNT
4 1600 1599 1600
80 400 399 400
256 750 746 749
1550 1956 1166 1188
2560 200 196 199

A saída do snmpwalk da tabela de estatísticas de buffer CFW corresponde a este comando show no PIX local.

PIX-520B#show block
TAMANHO MAX BAIXO CNT
4 1600 1599 1600
80 400 397 400
256 1500 1497 1499
1550 2468 1686 1700
2560 200 198 199

Verifique o túnel de IPsec

  • show crypto ipsec sa Remoto

    PIX515A#show crypto ipsec sa 
    
    
    interface: outside
        Crypto map tag: vpn, local addr. 192.168.1.2
    
       local  ident (addr/mask/prot/port): (10.99.99.0/255.255.255.0/0/0)
       remote ident (addr/mask/prot/port): (172.18.124.0/255.255.255.0/0/0)
       current_peer: 192.168.1.1
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 1962, #pkts encrypt: 1962, #pkts digest 1962
        #pkts decaps: 1963, #pkts decrypt: 1963, #pkts verify 1963
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0, 
        #pkts decompress failed: 0
        #send errors 0, #recv errors 0
    
         local crypto endpt.: 192.168.1.2, remote crypto endpt.: 
            192.168.1.1
         path mtu 1500, ipsec overhead 56, media mtu 1500
         current outbound spi: 3411a392
    
         inbound esp sas:
          spi: 0x554ad733(1430968115)
            transform: esp-des esp-md5-hmac ,
            in use settings ={Tunnel, }
            slot: 0, conn id: 4, crypto map: vpn
            sa timing: remaining key lifetime (k/sec): (4608000/28472)
            IV size: 8 bytes
            replay detection support: Y
          spi: 0x63a866ca(1671980746)
            transform: esp-des esp-md5-hmac ,
            in use settings ={Tunnel, }
            slot: 0, conn id: 2, crypto map: vpn
            sa timing: remaining key lifetime (k/sec): (4607747/27373)
            IV size: 8 bytes
            replay detection support: Y
    
    
         inbound ah sas:
    
    
         inbound pcp sas:
    
    
         outbound esp sas:
          spi: 0x3411a392(873571218)
            transform: esp-des esp-md5-hmac ,
            in use settings ={Tunnel, }
            slot: 0, conn id: 3, crypto map: vpn
            sa timing: remaining key lifetime (k/sec): (4608000/28463)
            IV size: 8 bytes
            replay detection support: Y
          spi: 0x7523ba4a(1965275722)
            transform: esp-des esp-md5-hmac ,
            in use settings ={Tunnel, }
            slot: 0, conn id: 1, crypto map: vpn
            sa timing: remaining key lifetime (k/sec): (4607798/27366)
            IV size: 8 bytes
            replay detection support: Y
    
    
         outbound ah sas:
    
    
         outbound pcp sas:
    
    
    
       local  ident (addr/mask/prot/port): 
          (192.168.1.2/255.255.255.255/0/0)
       remote ident (addr/mask/prot/port): 
          (172.18.124.112/255.255.255.255/0/0)
       current_peer: 192.168.1.1
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 26, #pkts encrypt: 26, #pkts digest 26
        #pkts decaps: 7, #pkts decrypt: 7, #pkts verify 7
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0, 
        #pkts decompress failed: 0
        #send errors 12, #recv errors 0
    
         local crypto endpt.: 192.168.1.2, remote crypto endpt.: 
            192.168.1.1
         path mtu 1500, ipsec overhead 56, media mtu 1500
         current outbound spi: 326421ac
    
         inbound esp sas:
          spi: 0x6eeec108(1861140744)
            transform: esp-des esp-md5-hmac ,
            in use settings ={Tunnel, }
            slot: 0, conn id: 6, crypto map: vpn
            sa timing: remaining key lifetime (k/sec): (4608000/28159)
            IV size: 8 bytes
            replay detection support: Y
    
    
         inbound ah sas:
    
    
         inbound pcp sas:
    
       outbound esp sas:
          spi: 0x326421ac(845423020)
            transform: esp-des esp-md5-hmac ,
            in use settings ={Tunnel, }
            slot: 0, conn id: 5, crypto map: vpn
            sa timing: remaining key lifetime (k/sec): (4607994/28159)
            IV size: 8 bytes
            replay detection support: Y
    
    
         outbound ah sas:
    
    
         outbound pcp sas:
  • IPsec cripto sa da mostra local:

    PIX-520B#show crypto ipsec sa 
    
    interface: outside
        Crypto map tag: vpn, local addr. 192.168.1.1
    
       local  ident (addr/mask/prot/port): (172.18.124.0/255.255.255.0/0/0)
       remote ident (addr/mask/prot/port): (10.99.99.0/255.255.255.0/0/0)
       current_peer: 192.168.1.2
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 4169, #pkts encrypt: 4169, #pkts digest 4169
        #pkts decaps: 4168, #pkts decrypt: 4168, #pkts verify 4168
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0, 
        #pkts decompress failed: 0
        #send errors 2, #recv errors 0
    
         local crypto endpt.: 192.168.1.1, remote crypto endpt.: 
            192.168.1.2
         path mtu 1500, ipsec overhead 56, media mtu 1500
         current outbound spi: 63a866ca
    
         inbound esp sas:
          spi: 0x7523ba4a(1965275722)
            transform: esp-des esp-md5-hmac ,
            in use settings ={Tunnel, }
            slot: 0, conn id: 4, crypto map: vpn
            sa timing: remaining key lifetime (k/sec): (4607560/28160)
            IV size: 8 bytes
            replay detection support: Y
    
    
         inbound ah sas:
    
    
         inbound pcp sas:
    
    
         outbound esp sas:
          spi: 0x63a866ca(1671980746)
            transform: esp-des esp-md5-hmac ,
            in use settings ={Tunnel, }
            slot: 0, conn id: 3, crypto map: vpn
            sa timing: remaining key lifetime (k/sec): (4607705/28151)
            IV size: 8 bytes
            replay detection support: Y
    
    
         outbound ah sas:
    
    
         outbound pcp sas:
    
    
    
       local  ident (addr/mask/prot/port): 
          (172.18.124.112/255.255.255.255/0/0)
       remote ident (addr/mask/prot/port): 
          (192.168.1.2/255.255.255.255/0/0)
       current_peer: 192.168.1.2
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 8, #pkts encrypt: 8, #pkts digest 8
        #pkts decaps: 32, #pkts decrypt: 32, #pkts verify 32
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0, 
        #pkts decompress failed: 0
        #send errors 0, #recv errors 0
    
         local crypto endpt.: 192.168.1.1, remote crypto endpt.: 
            192.168.1.2
         path mtu 1500, ipsec overhead 56, media mtu 1500
         current outbound spi: 6eeec108
    
         inbound esp sas:
          spi: 0x326421ac(845423020)
            transform: esp-des esp-md5-hmac ,
            in use settings ={Tunnel, }
            slot: 0, conn id: 2, crypto map: vpn
            sa timing: remaining key lifetime (k/sec): (4607993/27715)
            IV size: 8 bytes
            replay detection support: Y
    
    
         inbound ah sas:
    
    
         inbound pcp sas:
    
    
         outbound esp sas:
          spi: 0x6eeec108(1861140744)
            transform: esp-des esp-md5-hmac ,
            in use settings ={Tunnel, }
            slot: 0, conn id: 1, crypto map: vpn
            sa timing: remaining key lifetime (k/sec): (4608000/27706)
            IV size: 8 bytes
            replay detection support: Y
    
    
         outbound ah sas:
    
    
         outbound pcp sas:

Saída de syslog

  • Saídas de SYSLOG remotas:

    #more /var/log/remote.log
    
    Oct 11 22:28:08 192.168.1.2 Oct 11 2001 18:08:01: %PIX-6-302010: 
    0 in use, 4 most used
    Oct 11 22:28:08 192.168.1.2 Oct 11 2001 18:08:01: %PIX-6-302010: 
    0 in use, 4 most used
    Oct 11 22:38:07 192.168.1.2 Oct 11 2001 18:18:01: %PIX-6-302010: 
    0 in use, 4 most used
    Oct 11 22:38:07 192.168.1.2 Oct 11 2001 18:18:01: %PIX-6-302010: 
    0 in use, 4 most used
    Oct 11 22:47:50 192.168.1.2 Oct 11 2001 18:27:44: %PIX-5-111007: 
    Begin configuration: console reading from terminal
    Oct 11 22:47:50 192.168.1.2 Oct 11 2001 18:27:44: %PIX-5-111007: 
    Begin configuration: console reading from terminal
    Oct 11 22:47:57 192.168.1.2 Oct 11 2001 18:27:51: %PIX-5-111005: 
    console end configuration: OK
    Oct 11 22:47:57 192.168.1.2 Oct 11 2001 18:27:51: %PIX-5-111005: 
    console end configuration: OK
  • Saídas de SYSLOG locais:

    #more /var/log/local.log
    
    Oct 11 22:54:03 [172.18.124.211.2.2] %PIX-5-111005: 
    console end configuration: OK
    Oct 11 22:54:03 [172.18.124.211.2.2] %PIX-5-111005: 
    console end configuration: OK
    Oct 11 22:54:07 [172.18.124.211.2.2] %PIX-5-111007: Begin configuration: 
    console reading from terminal
    Oct 11 22:54:07 [172.18.124.211.2.2] %PIX-5-111007: Begin configuration: 
    console reading from terminal
    Oct 11 22:54:11 [172.18.124.211.2.2] %PIX-5-111005: 
    console end configuration: OK
    Oct 11 22:54:11 [172.18.124.211.2.2] %PIX-5-111005: 
    console end configuration: OK
    Oct 11 22:54:26 [172.18.124.211.2.2] %PIX-6-302010: 
       0 in use, 9 most used
    Oct 11 22:54:26 [172.18.124.211.2.2] %PIX-6-302010: 
       0 in use, 9 most used

Informações a serem coletadas se você abrir um caso de TAC

Se você ainda precisa o auxílio depois que você segue os passos de Troubleshooting neste documento e os quer abrir um pedido do serviço com o tac Cisco, seja certo incluir esta informação para pesquisar defeitos seu PIX Firewall.
  • Descrição do problema e detalhes relevantes de topologia
  • Troubleshooting realizado antes da abertura da solicitação de serviço
  • Saída do comando show tech-support
  • Saída do comando show log após a execução com o comando de depuração de registro colocado em buffer ou capturas do console que demonstram o problema (se disponível)
Anexe os dados coletados à sua requisição de serviço em um texto não compactado e simples (.txt). Você pode anexar a informação a seu pedido do serviço transferindo arquivos pela rede o que usa a ferramenta do pedido do serviço (clientes registrados somente). Se você não pode alcançar a ferramenta do pedido do serviço, você pode enviar a informação em um anexo de Email a attach@cisco.com com seu número do pedido do serviço na linha de assunto de sua mensagem.

Discussões relacionadas da comunidade de suporte da Cisco

A Comunidade de Suporte da Cisco é um fórum onde você pode perguntar e responder, oferecer sugestões e colaborar com colegas.


Informações Relacionadas


Document ID: 4094