On 13/09/2011 07:00 PM, Francois Labreque wrote:

>>>> No, I mean there's a *hardware* firewall in the way. You know, with the
>>>> big Cisco sticker on it and the 3-digit price tag? (Although obviously
>>>> that's only because I'm at work right now. My house doesn't have one of
>>>> those...)
>>>
>
> You're off by two orders of magnitude. Most Cisco firewalls are in teh 5
> digit price tag.

True. But not this particular one.

http://www.ebuyer.com/135532-cisco-asa-5505-firewall-edition-bundle-asa5505-50-bun-k9

(Go on, hack me. You know you want to.)

>>> And that hardware firewall is completely incapable of forwarding ssh
>>> connections? Pretty useless, I'd say.
>>
>> No, I don't have the password to configure it.

Still stands.

>> (And besides, have *you*
>> tried configuring Cisco stuff? It's not exactly intuitive. You probably
>> need Certified Engineer status to figure it out.)
>
> You don't need to be a Cisco Certified Internetwork Expert to figure it
> out. The Cisco manuals are usually pretty easy to follow, and freely
> available on their web site.

Really? That might be worth reading...

> And it is actually pretty intuitive...
>
> - Give each interface an ip address.
> - Create your NAT tables.
> - And off you go.

 From what I've seen, you telnet into the router, enter a password, and 
then enter lines of gibberish such as "enh eth gw all". You would 
*definitely* need a manual to figure out WTH that actually means, or 
what the name of the command you want is.

> The only difference between a Cisco firewall and a D-link or NetGear
> home router, besides performance and scalability, is that you can (and
> should!) override the basic "everything outbound is ok, nothing inbound
> can come in" configuration.

I'm still guessing that, between the configuration for routing to 
multiple LANs, multiple VPN endpoints, and remote access, adding a line 
that forwards SSH to a port on a desktop PC who's IP address is 
configured via DHCP is probably going to take some doing. (!)

And we still have the minor issue that I don't have the password. :-P

Actually, I have a NetGear router in my house. I used it to create a VPN 
between my house and my grandparents' house. It lets you do all sorts of 
port forwarding and stuff. The only trouble is... it's not reliable. 
Like, when certain datagrams pass through it, the firmware crashes, and 
you have to power-cycle it to get the Internet back. Eventually I was 
forced to take it out of the circuit, because it was pissing me off so 
much! (No, there isn't a firmware update available.)

Given the price of the Cisco ASA, I'm almost tempted...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message