được phát triển trong một nỗ lực hợp tác của Microsoft, Cisco Systems, Ascend, 3Com, và các nhà lãnh đạo mạng lưới ngành công nghiệp khác. Nó kết hợp các tính năng chuyển tiếp của Cisco lớp 2 (L2F) giao thức thực hiện PPTP Microsoft. L2TP | Configuring and Securing the Cisco PIX Firewall Chapter 9 397 Table Continued Level Type Description 4 Warnings Warning message 5 Notifications Normal but significant condition 6 Informational Information message 7 Debugging Debug messages and log FTP commands and WWW URLs An example of sending warnings to a syslog server is pixfirewall enable pixfirewall coniigure terminal pixfirewall coniig logging trap 4 pixfurewall config logging host inside tcp NOTE_ Syslog is not a secure protocol. The syslog server should be secured and network access to the syslog server should be restricted. Securing the PIX Since the PIX is a security device limiting access to the PIX to only those who need it is extremely important. What would happen if individuals where able to Telnet freely to the PIX from the inside network Limiting access to the PIX can be achieved by using the telnet command. Telnet is an insecure protocol. Everything that is typed on a Telnet session including passwords is sent in clear text. Individuals using a networkmonitoring tool can then capture the packets and discover the password to login and enable a password if issued. If remote management of the PIX is necessary the network communication should be secured. It is also a good idea to limit the idle-time of a Telnet session and log any connections to the PIX through Telnet. When possible use a RADIUS Kerberos or TACACS server to authenticate connections on the console or vty Telnet ports telnet ip_address netmask interface_name 398 Chapter 9 Configuring and Securing the Cisco PIX Firewall where Ip_address is an IP address of a host or network that can access the PIX Telnet console. If an interface name is not specified the address is assumed to be on the internal interface. PIX automatically verifies the IP address against the IP addresses specified by the ip address commands to ensure that the address you
