This article applies to:

• Security Reporting Center 2.X
• Firewall Suite 4.X

Symptoms:

• Cisco PIX 4.2.2 reports are showing all traffic as 'other'.

Causes:

Cisco PIX 4.2.2 only logs the proper protocol information if the fixup protocol configuration setting is in use.

Information:

The user will have to enter a fixup command for each protocol he or she expects to be listed in the log file in order to have it properly appear within the report. The format of this configuration setting is shown below.

Fixup protocol examples are shown below.

Basic format: fixup protocol (protocol name) (port)

For http protocol: fixup protocol http 80

For smtp protocol: fixup protocol smtp 25

For ftp protocol: fixup protocol ftp 21

These settings are entered from the command line, and can be altered to the custom settings a firewall administrator may have for his or her firewall. It is important to keep in mind however, that if you are having certain protocols routed through custom ports, or if you have non-standard protocols you want listed in your log files, you must set the proper "fixup protocol" settings for each.

Users should also make certain that any custom protocol names they have defined are also properly set within the Protocols tab of Options. This will ensure that the reports contain the proper data.

Notes:

Users should review the Cisco documentation about the purpose of fixup protocol before applying these settings. For a specific caution about MailMarshal SMTP, see Trustwave Knowledgebase article Q10068 (Duplicate e-mail messages are received when MailMarshal SMTP is running behind a Cisco PIX firewall).

This article was previously published as:

NETIQKB1109