-------------------------------------------------------------
ReadMe for PIX Outbound/Conduit Conversion Tool, Version 1.2
-------------------------------------------------------------

The PIX Outbound/Conduit Conversion tool assists in converting  configurations with outbound or conduit commands to similar configurations using Access Control Lists (ACLs). The Conversion tool reads the configuration file named on the Command Prompt and creates a converted configuration file. 
Note: You MUST manually verify the output for correctness before deploying it in a production network.
This ReadMe document contains the following sections:
1. Advantage of ACL over Outbound and Conduit
2. Target User
3. What’s New
4. Features Not Supported in this Version
5. Supported Platforms
6. Converting Conduits
7. Converting Outbound Lists
8. Accessing the PIX Outbound/Conduit Conversion Tool
9. Using the PIX Outbound/Conduit Conversion Tool
10. Known Caveats

1. Advantage of ACL over Outbound and Conduit
----------------------------------------------
ACL-based configurations provide uniformity and leverage the powerful ACL feature set. ACL-based configurations provide the following benefits:
* Access-list Element (ACE) Insertion Capability
System configuration and management is greatly simplified by the ACE insertion capability that allows users to add, delete, or modify individual ACEs.
* ACL Supports Remarks
ACL entries can be identified easily within large system configurations using remarks.
* Turbo ACLs
Turbo ACLs provide enhanced performance and scalability for larger ACLs.
* Object Grouping Support
Object groups are not supported by the outbound command.
* Defining Traffic
ACLs are commonly employed by most PIX features to define traffic designated for that feature (IPSec, nat 0, AAA, etc.).
* Future of PIX and ACL-Based Configurations
All new access control features in PIX will be based on the ACL model. Examples include time-based ACLs and outbound-based ACLs.

2. Target User
-------------------
The target user for the PIX Outbound/Conduit Conversion tool is a Cisco PIX Firewall administrator having experience configuring PIX. The administrator must have an understanding of the outbound, conduit, access-list, object group, nat, global, static, and route commands of the PIX.

3. What’s New
----------------
Version 1.2 supports the following new features:
- Use of object groups in conduit and (nat) 0 access-list commands.
- Use of the interface keyword in conduit commands.
- Use of the pppoe setroute and the dhcp setroute commands.
- Use of outside and dns (Domain Name System) keywords in static and nat commands.
- Use of routing information to eliminate unneeded ACL entries for traffic that should flow through a different interface. 
Note: This feature is disabled if Routing Information Protocol (RIP) and Open Shortest Path First (OSPF) commands are present in the configuration.
- Potential conflict avoidance between ACL rules generated by outbound commands and those generated by conduit commands. 
The default behavior for incoming packets on a PIX interface changes when an ACL is applied to the interface. Packets destined for lower security interfaces are normally permitted unless explicitly denied by an outbound rule; when an ACL is applied to the interface, packets are normally denied, unless explicitly permitted by an ACL rule. Therefore, converting a conduit to an ACL is likely to deny outbound packets that were permitted by the previous configuration.
To resolve this conflict the converter derives an object group for inbound traffic for each intermediate (not highest or lowest security) interface and substitutes the derived object group as the destination for a conduit that has “any” as its destination. The derived object group consists of all addresses exposed on the interface for inbound traffic by static, global, nat 0, and nat 0 access-list commands. If the ACL rules from conduits do not cover all of the exposed addresses, or if there are no conduit rules, a rule is added denying Internet Protocol (IP) traffic to the derived object group. This is followed by rules generated by any outbound commands and finally a rule permitting IP to “any”, allowing any outbound traffic not denied by rules from outbound commands. 
If an interface has no rules from conduits or outbounds, the default behavior is to not add ACL for that interface, leaving the interface to behave in the PIX default manner, allowing all outbound traffic and denying all inbound traffic. The Cisco Firewall Services Module (FWSM) default behavior is to deny all traffic. To maintain the PIX default behavior denying inbound traffic and permitting outbound traffic, a Command Line option (-pde) is provided to add rules denying traffic to the exposed addresses and permitting all other traffic to all intermediate interfaces that would otherwise have no ACL. This option also adds a rule to the inside interface permitting all IP, as there can be no inbound traffic for the inside interface.

4. Features Not Supported in This Version
--------------------------------------------------
The Outbound/Conduit Converter tool does not support the following features:
- alias 
- policy nat
- converting configurations combinations of both an exposure of all addresses behind an internal (higher security) interface, and either a default route to the same interface or commands enabling RIP/OSPF. 
The tool will output an error in the following scenario:

the configuration has network address translation exposing IP addresses behind a higher security interface (example, an inside interface with security level 100) to an intermediate interface (example, dmz interface with security level 50) with "nat (inside) 0 0 0 0", "nat (inside) 0 access-list with a permit ip any any entry” or "static (inside, dmz) 0.0.0.0 0.0.0.0 netmask 0.0.0.0”, and there is a default route to that higher security interface (inside) or RIP/OSPF is enabled.

Examples of unsupported combinations include:

* nat (inside) 0 0 0 0 
  route inside 0.0.0.0 0.0.0.0 <an ip on the inside interface>

* access-list no-nat permit ip any any
  nat (inside) 0 access-list no-nat
  route inside 0.0.0.0 0.0.0.0 <an ip on the inside interface>

* static (inside,dmz) 0.0.0.0 0.0.0.0 netmask 0.0.0.0
  route inside 0.0.0.0 0.0.0.0 <an ip on the inside interface>

5. Supported Platforms
----------------------
Microsoft Windows:
The tool runs on Win95, Win98, WinME, Win2K and WinXP. After you download the Conversion tool, extract the application (see “Accessing the Conversion Tool”). 
Note: Version 1.2 has no dynamic link libraries (DLLs) to be extracted.

Solaris:
The tool runs on Solaris 2.8 (SunOS 5.8). After you download the Conversion tool, gunzip the application, with the command 
“gunzip <filename>”. 

6. Converting Conduits
------------------------
A conduit is an exception to the PIX Firewall Adaptive Security mechanism. It permits connections from one network interface to access hosts on another.
Note: Conduit commands can apply to any but the inside interface.
The PIX Outbound/Conduit Conversion tool checks for overlaps between the global address of the conduit and each of the following:
 *  Global address in statics on the interface.
 *  Pool address(es) in globals on the interface.
 *  Local address in nat 0s or nat 0 access-lists on higher     security-level interfaces.
 *  Interface address.
Note: When a nat 0 command exists on an interface, any conduits matching the nat 0 are converted to ACL entries. These ACL entries are then applied to all interfaces that have a lower security level, unless: (1) a global or static command matches the local addresses in the nat 0 or nat 0 access-list command, or (2) it can be determined from the available routing information that the traffic belongs to a particular interface.
Note: When dhcp setroute or pppoe setroute is applied to the outside interface, a default route to the outside interface is added to the routing information.
If no overlaps apply, the Conversion tool does not create an ACL entry for the conduit on that particular interface.

7. Converting Outbound Lists
-----------------------------
An outbound list is based on the source IP address, the destination IP address, and the destination port or protocol, as specified by the access rules. Outbound lists control Internet use by specifying:
 * If inside users can create outbound connections.
 * If inside users can access specific outside servers.
 * What services are available to inside users for outbound connections and for accessing outside servers.
The Cisco PIX Firewall uses an algorithm to determine which outbound command to apply to a given incoming packet. Packets are denied by either the outgoing_src list or the outgoing_dst list. 
The PIX Outbound/Conduit Conversion tool considers an outbound command with a narrower address mask to be a better match, regardless of the service. If the address masks are equal, a more specific service is a better match.

7.1 Important Notes Regarding Specific Service
-----------------------------------------------
*  Specific service types are recognized as a descending list (from the most specific to the least specific):
    --  Single port on a transport protocol.
    --  Range of ports on a transport protocol.
    --  Wider range of ports on a transport protocol.
    --  All ports on a transport protocol.
    --  All IP traffic.
 * If two outbound commands are identical, a permit action is a better match than a deny action. 
 * If two outbound commands are identical, the order in which they appear in the configuration determines the better match.
 * If two outbound commands have the same list ID, the one appearing first is the better match. 
 * If two outbound commands have different list IDs, the one with the list ID matching the apply command that appears second is the better match.

8. Accessing the PIX Outbound/Conduit Conversion Tool
-----------------------------------------------------
The PIX Outbound/Conduit Conversion Tool is accessible both online and as a standalone application.

8.1 Accessing the Standalone Version
--------------------------------
To download the standalone version, go to the following URL:
	 http://www.cisco.com/cgi-bin/tablebuild.pl/pix

8.2 Accessing the Online Version
--------------------------------
Note: You must be a Cisco.com registered user to access download or the online tool. To become a registered Cisco.com user, complete the form at: http://tools.cisco.com/RPF/register/register.do

To use the online version, go to the following URL:
https://www.cisco.com/cgi-bin/Support/OutputInterpreter/home.pl

If you encounter any difficulties, contact the Technical Assistance Center. For online documents and troubleshooting, go to: http://www.cisco.com/tac.
To open a TAC case online, go to: http://www.cisco.com/tac/caseopen. 
To open a case by telephone, use one of the following numbers:
* Asia-Pacific: +612 8446 7411 (Australia: 1 800 805 227)
* EMEA: +32 2 704 55 55
* USA: 1 800 553-2447
For a complete listing of Cisco TAC contacts, go to this URL:
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml

9. Using the PIX Outbound/Conduit Conversion Tool
-------------------------------------------------
The PIX Outbound/Conduit Conversion Tool is available both online and as a standalone application.

9.1 Using the Standalone Version
----------------------------------------
To convert a configuration file using the PIX Outbound/Conduits Conversion tool, follow these steps:
 
Note:  You can convert only one file at a time.
 
Step 1  Open a Command Prompt window from MS Windows or an xterm for Solaris version.
 
Step 2  Change the directory path to the path where you extracted the Conversion tool.
 
Step 3  Enter the following command, substituting filenames shown with actual filenames, then press Return.  
        
        occ old_config_name > new_config_name
              
Step 4  Wait a few seconds for the conversion process to complete.
 
Command Line options:
 
-? or -help: displays options
-d or -debug: displays reasons for creating ACL rules
-dyy: displays yacc debugging information (formerly -d or -debug)
-ignoreroute: don't check routing information to eliminate unnecessary acl rules
-nodefaultpermits: doesn't add permit ip any any rule to allow outbound traffic through intermediate interfaces by default
-noothers: doesn't print the commands that are just passed through
-optimize: doesn't add rules generated from conduits if the rule is covered by a previous rule
-pde:  adds ACL rules to mimic PIX default inbound/outbound behavior everywhere
-v or -version: displays tool version

9.2 Using the Online Version
----------------------------

Step 1	Paste the output of the write term command from your PIX into the Output Interpreter for analysis (multiple commands are acceptable), or enter a filename and upload your configuration.

Step 2	Click the “Submit” button.

Step 3	Click on the link “WRITE TERMINAL – CONDUIT/OUTBOUND CONVERSION TOOL Analysis” for the converted output.

	Note: The optional parameters are available only on the standalone version, not on the online version.

10. Known Caveats
-----------------

1. Symptoms: The PIX Outbound/Conduit Conversion tool does not detect disabled names.

Conditions: This symptom occurs with the following input in the configuration:
no names
name 2.2.2.1 EXCHANGE
static (DMZ,outside) 3.3.2.1 2.2.2.1 netmask 255.255.255.255 0 0

The PIX Outbound/Conduit Conversion tool converts the static configuration to:
no names
name 2.2.2.1 EXCHANGE
static (DMZ,outside) 3.3.2.1 EXCHANGE netmask 255.255.255.255 0 0

This fails, if the user cuts and pastes the converted configuration directly.

Workaround: There are two workarounds,
- Remove the name(s) from the configuration because the name(s) are not used (they are disabled),
or
- Enable the name, take the output of the write term again, and run the name through the PIX Outbound/Conduit Conversion tool.

2. Symptoms: The PIX Outbound/Conduit Conversion tool shows a syntax error when the interface keyword is used in access-list.

Conditions: This symptom occurs with the following configuration: 
access-list 101 permit ip interface inside any
OCC will report a syntax error.

The use of the interface keyword in the access-list is only useful when binding to an access-group.  PIX does not recommend use of access-list/access-group with outbounds/conduits.

Workaround: Remove the access-list element containing the interface keyword from the configuration.  Add the same access-list element after the conversion.