Cisco PIX 520 - PIX Firewall 520 Manuals

Index Glossary About PDM - New for PDM 1.1 PDM Icon Legend Getting Started Applying Configuration Changes in PDM Refresh More about Internet Protocol (IP) Unsupported Commands Help Topics by Location Access Rules Translation Rules Hosts/Networks System Properties Monitoring Menus Additional Resources Top Security Resources PIX Firewall Documentation Cisco Technical Assistance Center>PIX Firewall PIX Firewall Top Issues PIX Firewall Product Literature Copyright © 2001 Cisco Systems, Inc. This topic includes the following sections: Introduction G About PDM Software G System Requirements G Introduction Cisco PIX Device Manager (PDM) is the graphical user interface (GUI) for configuring and monitoring the Cisco PIX Firewall. PDM is available on all PIX 501, PIX 506, PIX 515, PIX 520, PIX 525, and PIX 535 platforms that are running PIX Firewall software version 6.0 or higher. PDM is designed to assist you in managing your network security. For example, PDM does the following: Helps you configure your PIX Firewall using visual tools like task-oriented selections and drop-down menus. G Sends PIX Firewall command-line interface (CLI) commands to the PIX Firewall unit for you. G Enables you to visually monitor your PIX Firewall system, connections, IDS, and traffic on the interfaces. G Can create new PIX Firewall configurations or modify existing configurations that were originally implemented using the PIX Firewall CLI or Cisco Secure Policy Manager (Cisco Secure PM). G Monitors and configures one PIX Firewall unit at a time, but you can point your browser to more than one PIX Firewall unit and administer several PIX Firewall units from a single workstation. G Runs on platforms that support Java and does not require a separate plug-in. (The PDM applet uploads to your workstation when you point your browser at the PIX Firewall.) G Uses Secure Socket Layer (SSL) to secure communication between itself (PDM) and the PIX Firewall and is a signed applet. G About PDM Software If your PIX Firewall unit is new and shipped with PIX Firewall software version 6.0 or higher, the PDM software is already loaded in the PIX Firewall Flash memory for you. If you are upgrading from a previous version of PIX Firewall, you need to use TFTP from the PIX Firewall to copy the PDM image to your PIX Firewall. For instructions on how to do this, refer to the PDM Installation Guide and Using a TFTP Server. Note If using PDM with an existing PIX Firewall configuration, refer to "PDM Support for PIX Firewall CL Commands," for information on which commands are supported and which are not. System Requirements This section includes the following topics: PIX Firewall Requirements G Browser Requirements G PC/Workstation Requirements G PIX Firewall Requirements Caution The PIX Firewall must have PIX Firewall software version 6.0 or higher installed and running for PDM to run. PDM does not run with earlier PIX Firewall software versions If you are using a PIX Firewall already running PIX Firewall software version 6.0 or higher, then you have already met all the requirements to run PDM that are discussed in "PIX Firewall Requirements"and can continue to the "Browser Requirements" section. For example, PIX Firewall units that contain PIX Firewall software version 6.0 or higher ship with a pre-installed DES activation key. Otherwise, a PIX Firewall unit must meet the following requirements to successfully install and run PDM: You must have an activation key that enables Data Encryption Standard (DES) or the more secure 3DES, which PDM requires for support of the Secure Socket Layer (SSL) protocol. G If your PIX Firewall is not enabled for DES, you can have a new activation key sent to you by completing the form at the following website: http://www.cisco.com/kobayashi/sw-center/internet/pix-56bit-license-request.shtml G Verify that your PIX Firewall meets all PIX Firewall software version 6.0 requirements listed in the Release Notes for the Cisco Secure PIX Firewall Version 6.0(1) or higher. You must have version 6.0 installed on the PIX Firewall unit before using PDM. You can download version 6.0 and the PDM softwar from the following website: http://www.cisco.com/cgi-bin/tablebuild.pl/pix G You must have at least 8 MB of Flash memory on the PIX Firewall unit. G Ensure that your configuration is less than 100 KB (approximately 1500 lines). Configurations over 100 KB cause PDM performance degradation. You can view the size of your configuration with the CLI show flashfs command as the length for "file 1." G Browser Requirements The following are required to access one or more PIX Firewall units through PDM: A JavaScript and Java enabled browser running JDK 1.1.4 or higher. If these are not enabled in the browser, PDM guides you on how to enable them. To check which version you have, launch PDM. When the PDM information window appears, the field "JDK Version" indicates your JDK version. If you have an older JDK version, you can get the latest JVM from Microsoft by downloading the product called "Virtual Machine." G Browser support for Secure Socket Layer (SSL) must be enabled. The supported versions of Internet Explorer and Netscape Navigator support SSL without requiring additional configuration. Note PIX Firewall software version 6.0 supports SSL 2.0, SSL 3.0, and TLS 1.0 in web browsers. PIX Firewall supports all browser encryption levels. G PC/Workstation Requirements PDM has different requirements depending on the platform from which you access it. PDM is not supported for use on computers equipped with the Macintosh, Windows 3.1, or Windows 95 operating systems. This section includes the following topics: Windows Requirements G SUN Solaris Requirements G Linux Requirements G Windows Requirements The following requirements apply to the use of PDM with Windows. PDM does not support use on Windows 3.1 or Windows 95. G Windows 2000 (Service Pack 1), Windows NT 4.0 (Service Pack 4 and higher), Windows 98, or Windows ME. G Supported browsers: Internet Explorer 5.0 (Service Pack 1) or higher (5.5 recommended), Netscape Communicator 4.51 or higher (4.76 recommended). We recommend Internet Explorer on Windows as PDM may load faster into this browser on this operating system. G Any Pentium or Pentium-compatible processor running at 350 MHz or higher. G At least 128 MB of random-access memory (RAM). We recommend 192 MB or more. G An 800 x 600 pixel display with at least 256 colors. We recommend a 1024 x 768 pixel display and at least High Color (16-bit) colors. Note The use of virus checking software may dramatically increase the time required for PDM to start This is especially true for Netscape Communicator on any Windows platform or Windows 2000 running any browser. G SUN Solaris Requirements The following requirements apply to the use of PDM with Sun SPARC: Sun Solaris 2.6 or later running CDE or OpenWindows window manager. G SPARC microprocessor. G Supported browser: Netscape Communicator 4.51 or higher (4.76 recommended). G At least 128 MB of random-access memory (RAM). G An 800 x 600 pixel display with at least 256 colors. We recommend a 1024 x 768 pixel display and at least High Color (16-bit) colors. G

Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 526-4100 Cisco PIX Device Manager Installation Guide Version 3.0 Text Part Number: 78-15483-01 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES This document is to be used in conjunction with the appropriate documentation for your Cisco PIX Firewall system. CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, In Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CC CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Regi ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are regist trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relations between Cisco and any other company. (0304R) Cisco PIX Device Manager Installation Guide Copyright © 2003 Cisco Systems, Inc. All rights reserved. iii Cisco PIX Device Manager Installation Guide, Version 3.0 78-15483-01 C O N T E N T S Preface vii Document Objectives vii Audience vii Installation Warning viii Safety Warning Description ix Document Organization xiii Document Conventions xiii Terms and Acronyms xiv Related Documentation xv Obtaining Documentation xv Cisco.com xv Documentation CD-ROM xv Ordering Documentation xv Documentation Feedback xvi Obtaining Technical Assistance xvi Cisco TAC Website xvi Opening a TAC Case xvi TAC Case Priority Definitions xvii Obtaining Additional Publications and Information xvii Overview 1 - 1 Introduction 1 - 1 Data Encryption Overview 1 - 2 PIX Firewall System Requirements 1 - 4 PIX Firewall System Interoperability with PDM 1 - 4 Flash Memory Requirements 1 - 5 Maximum Configuration File Size 1 - 5 Software Requirements 1 - 6 Upgrading to a New Software Release 1 - 6 PC/Workstation Requirements 1 - 6 Supported Platforms 1 - 8 Windows 1 - 8 Sun Solaris 1 - 9 Red Hat Linux 1 - 9 Contents iv Cisco PIX Device Manager Installation Guide, Version 3.0 78-15483-01 Preparing to Install PDM 2 - 1 Notes and Cautions 2 - 1 Caution 2 - 2 Installation Checklist 2 - 2 Preparing to Install PDM 2 - 3 Determining the IP Address of Your Server 2 - 4 Windows NT, Windows 2000, or Windows XP 2 - 4 Windows 98 or Windows ME 2 - 4 Sun Solaris 2 - 5 Linux 2 - 5 Installing PDM 3 - 1 Downloading the PDM Software 3 - 1 Downloading PDM from Cisco.com 3 - 1 Downloading PDM Using FTP 3 - 2 Installing PDM 3 - 2 Loading the PDM Image 3 - 4 Configuring PDM 4 - 1 Starting PDM with Internet Explorer 4 - 1 Starting PDM with Netscape Navigator 4 - 2 PDM Home Page 4 - 3 Using the PDM Startup Wizard 4 - 4 VPN Wizard 4 - 5 Site-to-Site VPN 4 - 5 Remote Access VPN 4 - 5 Select Interface 4 - 6 Configuring VPN Tunnels 4 - 6 Configuration Recommendations 4 - 6 Tips and Troubleshooting 5 - 1 Checking Your Connection to the PIX Firewall 5 - 1 Tips on Using PDM 5 - 2 Troubleshooting 5 - 3 Using a TFTP Server A - 1 Obtaining a Windows TFTP Server A - 1 Enabling UNIX TFTP Support A - 2 Enabling TFTP Access on a Sun Solaris System A - 2

Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 User Guide for the Catalyst Express 520 Switches Cisco IOS Release Number 12.2(37)EX September 2007 Text Part Number: OL-12761-02 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not installed in accordance with Cisco’s installation instructions, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation. Modifying the equipment without Cisco’s written authorization may result in the equipment no longer complying with FCC requirements for Class A or Class B digital devices. In that event, your right to use the equipment may be limited by FCC regulations, and you may be required to correct any interference to radio or television communications at your own expense. You can determine whether your equipment is causing interference by turning it off. If the interference stops, it was probably caused by the Cisco equipment or one of its peripheral devices. If the equipment causes interference to radio or television reception, try to correct the interference by using one or more of the following measures: • Turn the television or radio antenna until the interference stops. • Move the equipment to one side or the other of the television or radio. • Move the equipment farther away from the television or radio. • Plug the equipment into an outlet that is on a different circuit from the television or radio. (That is, make certain the equipment and the television or radio are on circuits controlled by different circuit breakers or fuses.) Modifications to this product not authorized by Cisco Systems, Inc. could void the FCC approval and negate your authority to operate the product. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. CCVP, the Cisco logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking Academy, Network Registrar, Packet, PIX, ProConnect, ScriptShare, SMARTnet, StackWise, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0705R) Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental. User Guide for the Catalyst Express 520 Switches © 2007 Cisco Systems, Inc. All rights reserved.

C H A P T E R 5-1 Cisco PIX Security Appliance Hardware Installation Guide 78-15170-02 5 PIX 520 This chapter guides you through the installation of the PIX 520, and includes the following sections: • PIX 520 Product Overview, page 5-1 • Installing the PIX 520, page 5-4 • PIX 520 Feature Licenses, page 5-6 • Installing Failover, page 5-7 • Installing LAN-Based Failover, page 5-8 • Removing and Replacing the PIX 520 Chassis Cover, page 5-10 • Replacing a Lithium Battery, page 5-12 • Installing a Memory Upgrade, page 5-12 • Installing a Circuit Board in the PIX 520, page 5-15 • Installing the PIX 520 DC Model, page 5-21 PIX 520 Product Overview This section describes the PIX 520 front and rear panels and the panel LEDs. Figure 5-1 shows the front view of the PIX 520. Figure 5-1 PIX 520 Front Panel PIX FirewallSERIES RESET 67852 5-2 Cisco PIX Security Appliance Hardware Installation Guide 78-15170-02 Chapter 5 PIX 520 PIX 520 Product Overview Figure 5-2 shows the rear view of the PIX 520. Figure 5-2 PIX 520 Rear Panel Note Use of the four-port Ethernet circuit board changes the position of the outside and inside interfaces depending on the slot in which the circuit board is installed. Four-port Ethernet connectors are numbered from the top connector down sequentially. On horizontally mounted cards, the slots are numbered left to right. The PIX 520 can be used with Ethernet circuit boards. The four-port Ethernet circuit board provides four 10/100 Ethernet connections and has autosense capability. Connectors on the four-port Ethernet circuit board are numbered top to bottom sequentially; however, the actual device number depends on the slot in which the four-port Ethernet circuit board is installed. Table 5-1 describes how the top connector is numbered. With the four-port Ethernet circuit board, having a circuit board in slot 3 makes the number of interfaces greater than six; while the circuit board in slot 3 cannot be accessed, its presence does not cause problems with the PIX security appliance. PIX FirewallSERIES RESET 67853 Auto-Range Selection L:90-135V H:180-270V Table 5-1 Numbering Devices with a Four-Port Connector Slot 0 Contains Slot 1 Contains Slot 2 Contains Four-Port Top Connector 4-port Any Any ethernet0 Ethernet 4-port Any ethernet1 Ethernet Ethernet 4-port ethernet2 Token Ring 4-port Any ethernet0 Token Ring Token Ring 4-port ethernet0 Token Ring Ethernet 4-port ethernet1 Ethernet Token Ring 4-port ethernet1 5-3 Cisco PIX Security Appliance Hardware Installation Guide 78-15170-02 Chapter 5 PIX 520 PIX 520 Product Overview Figure 5-3 shows the location of the interfaces if you install a four-port Ethernet circuit board in slot 0. Figure 5-3 Four-Port Ethernet Circuit Board Installed in Slot 0 Figure 5-4 shows how the slots are numbered if a single-port Ethernet circuit board is inserted in slot 0, and a four-port Ethernet circuit board is inserted in slot 1. Figure 5-4 Single-Port Ethernet Circuit Board Installed in Slot 0 and Four-Port Ethernet Circuit Board Installed in Slot 1 Figure 5-5 shows how the slots are numbered if single-port Ethernet circuit boards are installed in slot 0 and in slot 1, and a four-port Ethernet circuit board is inserted in slot 2. Figure 5-5 Single-Port Ethernet Circuit Board Installed in Slot 0 and 1 and Four-Port Ethernet Circuit Board Installed in Slot 2 44306 Interface 5 Interface 4 Interface 0 Interface 1 Interface 2 Interface 3 44307 Interface 0 Interface 1 Interface 2 Interface 3 Interface 4 44308 Interface 0 Interface 1 Interface 3 Interface 4 Interface 2 Interface 5 5-4 Cisco PIX Security Appliance Hardware Installation Guide 78-15170-02 Chapter 5 PIX 520 Installing the PIX 520 Installing the PIX 520 To install the PIX 520, perform the following steps: Step 1 Refer to Figure 5-6 for information on the features of the PIX 520. Figure 5-6 PIX 520 Front, Rear, and Side Panels. Step 2 Connect network cables to each of the PIX security appliance network interfaces. On the PIX 520, connect the cables at the front of the unit. PIX FirewallSERIES RESET Auto-Range Selection L:90-135V H:180-270V Power connector DC power connector Slots for network interfaces Front Rear Power switch Power switch Ground lugs Diskette compartment Right side Left side Fan duct Holes to connect rackmount slide rails (must be purchased separately from outside vendor) AC DC Failover connector Console connector Insert PIX security appliance diskette Reset button Power light 1 2 4 3 To access, loosen screws counterclockwise Set plate on surface To remove diskette, push button 10656 + – + – Rackmount holes Holes to connect rackmount brackets (if rackmounting is desired)