From: Volkov, Dmitry (IDS Canada) (dmitry_volkov@ca.ml.com)
Date: Fri Jun 06 2003 - 18:40:08 GMT-3
R1------(in)PIX(out)-----R2
FW does PAT for inside network to outside
Both peers trying to establish BGP via TCP 179.
FW blocks TCP 179 in one way (from outside to inside, because no transl slot
exist and no access-list conduit)
however neighboring is established via another way session (from inside to
outside) only.
So, it's enough one way TCP - no necessity to open TCP 179 from outside to
inside.
Is it right ?? Is there any rule - which session allowed to establish
neighboring
(like, I don't know, from higher BGP identifier to lower or something like
that) ?
Dmitry
This archive was generated by hypermail 2.1.4 : Fri Jul 04 2003 - 11:10:54 GMT-3