 Feedback
|
Table Of Contents
About the Cisco PIX 501 Firewall
Optional Maintenance and Upgrade Procedures
Upgrade to DES, 3DES/AES, or the User Licenses
Restore the Default Configuration
Alternative Ways to Access the PIX 501
Obtaining Technical Assistance
Obtaining Additional Publications and Information
Quick Start Guide
Cisco PIX 501 Firewall
About the Cisco PIX 501 Firewall
The PIX 501 delivers enterprise-class security for small offices and telecommuters in a reliable, plug-and-play security appliance. Ideal for securing high-speed "always on" broadband environments, the PIX 501, part of the world-leading Cisco PIX Firewall Series, provides robust security capabilities, small office networking features, and powerful remote management capabilities in a compact, all-in-one solution:
•
Stateful inspection security based on state-of-the-art Adaptive Security Algorithm (ASA)
•
•
•
•
•
1 Check Items Included
2 Installing the PIX 501
Follow these steps to connect the cables:
Step 1
Step 2
a.
b.
Step 3
Note
Make sure the PC interface connected to the PIX 501 inside port, numbered 1 through 4, is set to autonegotiate for best performance. If autonegotiate is not an option for the PC interface, set the speed to either 10 or 100 Mbps half duplex. Setting the interface to full duplex causes a duplex mismatch that significantly impacts the total throughput capabilities of the interface.
Follow these steps to power on the PIX Firewall:
Step 1
Step 2
Step 3
Note
Step 4
3 Configuring the PIX 501
The PIX 501 comes with a factory default configuration that meets the needs of most broadband networking environments. The factory default configuration on the PIX 501 protects your inside network from any unsolicited traffic. It is configured to use DHCP on the outside interface to acquire its IP address. A default DHCP server address pool is included for hosts on the inside interface.
By default, the PIX Firewall denies all inbound traffic through the outside interface. Based on your network security policy, you should consider configuring the PIX Firewall to deny all ICMP traffic to the outside interface, or any other interface you deem necessary, by entering the icmp command. The icmp command controls responses to ICMP traffic that is directed at one of the PIX Firewall interfaces. If no ICMP control list is configured, then the PIX Firewall will respond to all ICMP requests received on any interface (including the outside interface).
For more information about the icmp command, refer to the Cisco PIX Firewall Command Reference.
Instances in which it might be necessary to change or make additional changes to the default configuration include the following:
•
Note
•
•
The PIX 501 contains an integrated configuration utility called Cisco PIX Device Manager (PDM). PDM is a web browser-based configuration tool designed to help you set up, configure, and monitor the PIX Firewall.
PDM is preinstalled on the PIX 501. To access PDM, make sure JavaScript and Java are enabled in your web browser. Refer to the Cisco PIX Device Manager Installation Guide for more information on the operating system and web browser environments supported by PDM.
PDM Version 2.0 and higher releases include a Startup Wizard for initial configuration. Follow these steps to use the Startup Wizard:
Step 1
Note
Step 2
Note
Step 3
Step 4
Note
Step 5
Step 6
4 Optional Maintenance and Upgrade Procedures
Upgrade to DES, 3DES/AES, or the User Licenses
Note
To upgrade features you did not specify at the time of purchase, you need to use an activation key. The activation key lets you add software features to the PIX Firewall, such as DES (Free) or 3DES/AES, or upgrade the user license at an additional cost.
If you are a registered user of Cisco Connection Online and would like to obtain a DES or a 3DES/AES license key, or upgrade your user license for the PIX Firewall, go to the following website:
http://www.cisco.com/pcgi-bin/Software/FormManager/formgenerator.pl
If you are not a registered user of Cisco Connection Online, go to the following website:
http://www.cisco.com/pcgi-bin/Software/FormManager/formgenerator.pl
Note
You must also purchase or have a service contract to download PIX Firewall software.
Note
To obtain an activation key, you need a Product Authorization Key, which you can purchase from your Cisco account representative. After obtaining the Product Authorization Key, register it on the web to obtain an activation key by performing the following steps:
Step 1
•
•
Step 2
Step 3
•
•
•
The activation key is generated automatically and sent to the e-mail address that you provide.
Follow these steps to use the activation key:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
For more information on activation key examples or upgrading software, refer to the Cisco PIX Firewall and VPN Configuration Guide.
Active Host Limitation
The PIX 501 supports up to 32 DHCP address leases with a 10-user license, up to 128 with an optional 50-user license, and 256 with an unlimited user license. A host is considered active when any of the following statements are true:
•
•
•
•
Refer to the System Properties>Advanced>Timeouts online Help topic within PDM for the default inactivity timeout values associated with each of the preceding bulleted items.
Restore the Default Configuration
You can restore your configuration back to the factory default values in one of the following ways:
•
•
Step 1
configure factory-default [inside ip address [address_mask]] 1
Erases the running configuration and replaces it with the factory default configuration.
Step 2
write memory
Writes the factory default configuration to Flash memory.
1 If the optional inside IP address and address mask are specified, the factory-default configuration will reflect the specified IP address.
Note
Caution
Refer to the following website for detailed command information and configuration examples:
http://www.cisco.com/en/US/docs/security/pix/pix63/command/reference/cmdref.html
The Cisco TAC website is available to all customers who need technical assistance. To access the TAC website, go to:
Alternative Ways to Access the PIX 501
You can access the CLI for administration using the console port on the PIX Firewall. To do so, you must run a serial terminal emulator on a PC or workstation.
Follow these steps to connect a console for local administrative access:
Step 1
Step 2
Step 3
Step 4
For information on how to access the PIX Firewall configuration mode, refer to the "Accessing Configuration Mode" section in Chapter 1, "Getting Started" of the Cisco PIX Firewall and VPN Configuration Guide.
You can also access the CLI using SSH/Telnet to the PIX Firewall. By default, SSH/Telnet access is not permitted. Use PDM or the console to configure SSH/Telnet access to the PIX Firewall. To Telnet to the PIX Firewall from the outside perimeter of the PIX Firewall, configure an outside IP address and IPSec for a secure Telnet session. Refer to the Cisco PIX Firewall and VPN Configuration Guide for more information about how to use the CLI.
Check the LEDs
The LINK/ACT LED indicators on the front panel of the PIX Firewall are normally solid green when a link is established and flashing green when the ports are active. Each inside Ethernet interface (numbered 1 through 4) has two LEDs to indicate the operating speed and that the physical link is established.
Note
Install a Cable Lock
The PIX 501 includes a slot that accepts standard desktop cable locks to provide physical security for small portable equipment, such as a laptop computer. The cable lock is not included.
Follow these steps to install a cable lock:
Step 1
Step 2
5 Obtaining Documentation
Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation on the World Wide Web at this URL:
http://www.cisco.com/en/US/support/index.html
You can access the Cisco website at this URL:
International Cisco websites can be accessed from this URL:
http://www.cisco.com/public/countries_languages.shtml
Documentation CD-ROM
Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated regularly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual or quarterly subscription.
Registered Cisco.com users can order a single Documentation CD-ROM (product number DOC-CONDOCCD=) through the Cisco Ordering tool:
http://www.cisco.com/en/US/partner/ordering/ordering_place_order_ordering_tool_launch.html
All users can order annual or quarterly subscriptions through the online Subscription Store:
http://www.cisco.com/go/subscription
Ordering Documentation
You can find instructions for ordering documentation at this URL:
http://www.cisco.com/en/US/support/index.html
You can order Cisco documentation in these ways:
•
http://www.cisco.com/en/US/partner/ordering/index.shtml
•
Documentation Feedback
You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page.
You can send your comments in e-mail to bug-doc@cisco.com.
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883We appreciate your comments.
6 Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco Technical Assistance Center (TAC) provides 24-hour, award-winning technical support services, online and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical assistance.
Cisco TAC Website
The Cisco TAC website (http://www.cisco.com/tac) provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC website is available 24 hours a day, 365 days a year.
Accessing all the tools on the Cisco TAC website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a login ID or password, register at this URL:
http://tools.cisco.com/RPF/register/register.do
Opening a TAC Case
The online TAC Case Open Tool (http://www.cisco.com/tac/caseopen) is the fastest way to open P3 and P4 cases. (Your network is minimally impaired or you require product information). After you describe your situation, the TAC Case Open Tool automatically recommends resources for an immediate solution. If your issue is not resolved using these recommendations, your case will be assigned to a Cisco TAC engineer.
For P1 or P2 cases (your production network is down or severely degraded) or if you do not have Internet access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2 cases to help keep your business operations running smoothly.
To open a case by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447For a complete listing of Cisco TAC contacts, go to this URL:
http://www.cisco.com/en/US/support/tsd_cisco_worldwide_contacts.html
TAC Case Priority Definitions
To ensure that all cases are reported in a standard format, Cisco has established case priority definitions.
Priority 1 (P1)—Your network is "down" or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Priority 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Priority 3 (P3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Priority 4 (P4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
7 Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•
http://www.cisco.com/en/US/doctypes/prod_series_index_listing_sitecopy.html
•
•
http://www.cisco.com/go/packet
•
http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.htm
•
