How to open port 22 on PIX 515 firewall

[mtsch...@yahoo.com]

I need to be able to connect to outside SFTP server using port 22.
How do I open port 22 on our PIX firewall?
Please keep it simple since I don't know much about PIX.

Thanks in advance - Mark

[Lutz Donnerhacke]

* mtsch...@yahoo.com wrote:
> I need to be able to connect to outside SFTP server using port 22.
> How do I open port 22 on our PIX firewall?

Using access-list and access-group.

But I fear you will run into much trouble, because SFTP is encrypted and
therefore can't be inspect by the PIX. So you have to allow nearly every TCP
stream between both servers.

> Please keep it simple since I don't know much about PIX.

There are good configuration guides on the Cisco website.

[Newbie72]

By default the pix will allow outbound traffic from higher to
lower(inside network to outside network interfaces) to lower security
interfaces without having to do anything other than enabling NAT using
the global commands. Post your config so we can see what us already
have.

Steve

[mtsch...@yahoo.com]

Thanks for your reply - I need something more specific - I did look at
cisco but didn't find anything I could use.

Mark

[Lutz Donnerhacke]

* mtsch...@yahoo.com wrote:

> Lutz Donnerhacke wrote:
>> There are good configuration guides on the Cisco website.
>
> Thanks for your reply - I need something more specific - I did look at
> cisco but didn't find anything I could use.

http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_2/conf_gd/firewall/traffic.htm#wp1047858

[SAto]

Lutz Donnerhacke skrev:

> But I fear you will run into much trouble, because SFTP is encrypted and
> therefore can't be inspect by the PIX. So you have to allow nearly every TCP
> stream between both servers.

SFTP uses only port 22 as it is tunneled through SSH.
You may be thinking of FTPS which uses random ports.

SFTP should be pretty simple to set up using access list permitting tcp
port 22.

-SAto

[J]

Unfortunately marketing has bastardized the acronyms to the point of
being useless. He could be attempting to set up either of the (SSL or
SSH). Knowing what actual application he plans on using would be of
great here here.

J

[Lutz Donnerhacke]

* SAto wrote:
> Lutz Donnerhacke skrev:
>> But I fear you will run into much trouble, because SFTP is encrypted and
>> therefore can't be inspect by the PIX. So you have to allow nearly every TCP
>> stream between both servers.
>
> SFTP uses only port 22 as it is tunneled through SSH.
> You may be thinking of FTPS which uses random ports.

Yep. I confused "SFTP", "FTPS" and "Secure-FTP". Sorry.