Fw: cisco pix does not log traffic targetted to itself?

["Jose y Romy" <joseromy () telefonica net>]

----- Original Message -----
From: "Jose y Romy" <joseromy () telefonica net>
To: "Toh Kar Lai Catherine" <kltoh () ncs com sg>
Sent: Monday, January 06, 2003 5:56 PM
Subject: Re: [fw-wiz] cisco pix does not log traffic targetted to itself?


> > My cisco pix firewall is logging denied traffic normally. However when I
> > tried using a scanner to scan the cisco pix firewall itself, a few open
> > ports were discovered but no traffic of the scan was captured in the
log.
> In
> > other words, the firewall didn't log my scan activity. What can I do to
to
> > ensure that any activity targetted to my firewall is logged?
 Well ,be sure you are logging in the right level (see theoutput of the
"show
 logging " command),if you are logging in the wrong level,maybe you won´t
see
 any interesting messages.......
 another thing is the own buffer of the Pix,if you are not logging to a
 syslog server but the Pix buffer,the Pix will overwrite the messages (4 KB
I
 think...)

> > Also is it true that the cisco pix firewall deny all traffics that is
not
> > permitted in the rule-base BY DEFAULT? Is there a need to insert a last
> rule
> > that deny any to any?
 Well,Pix uses the security levels at the interfaces ,and by default do not
 permit (except ACL or static/conduit command)the traffic from a less secure
 to a more secure
 interface (by default 0 (lower level) is assigned to the outside interface
 and 100 (higher level) to the inside interface).
 In the normal ACLs there is an implied "deny all" at the end.
 Greetings

 Jose M Mejía


_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards