Cisco PIX 500 Series Security Appliances

The document addresses the most frequently asked questions (FAQs) related to Cisco Security Appliances like PIX 500 Series and ASA 5500 Series..

The target audience for this document is a security appliance administrator who understands CLI commands and features, and has experience with the configuration of earlier PIX software versions.

A. PIX 515, PIX 515E, PIX 525, PIX 535 and all of the Cisco ASA 5500 Series Adaptive Security Appliances (ASA 5510, ASA 5520, and ASA 5540) support software version 7.x.

The PIX 501, PIX 506E, and PIX 520 Security Appliances are not supported in software version 7.x.

A. The PIX Security Appliance can operate in two different firewall modes:

1. Routed mode—In routed mode, the PIX has IP addresses assigned to its interfaces and acts as a router hop for packets that pass through it. All traffic inspection and forwarding decisions are based on Layer 3 parameters. This is how PIX Firewall versions earlier than 7.0 operate.

2. Transparent mode—In transparent mode the PIX does not have IP addresses assigned to its interfaces. Instead it acts as a Layer 2 bridge that maintains a MAC address table and makes forwarding decisions based on that. The use of full extended IP access lists is still available and the firewall can inspect IP activity at any layer. In this mode of operation the PIX is often referred to as a "bump in the wire" or "stealth firewall". There are other significant differences as to how transparent mode operates in comparison to routed mode:

   • Only two interfaces are supported—inside and outside

   • NAT is not supported or required since the PIX is no longer a hop.

Note: Because transparent and routed modes use different approaches to security, the running configuration is cleared when the PIX is switched to transparent mode. Be sure to save your routed mode running configuration to Flash or an external server.

A. You can partition a single hardware PIX into multiple virtual devices, known as Security Contexts. Each context becomes an independent device, with its own security policy, interfaces, and administrators. Multiple contexts are similar to having multiple standalone devices. Many features are supported in multiple context mode and include routing tables, firewall features, IPS, and management. Some features are not supported, including VPN and dynamic routing protocols.

A. PIX 7.0 has three times more syslogs and new features than the 6.x versions. Increased CPU usage compared to 6.x is normal.

A. There are two options in PIX 7.x that allow inside users to ping outside. The first option is to setup a specific rule for each type of echo message. For example:

access-list 101 permit icmp any any echo-reply
        access-list 101 permit icmp any any source-quench 
        access-list 101 permit icmp any any unreachable  
        access-list 101 permit icmp any any time-exceeded
        access-group 101 in interface outside

This allows only these return messages through the firewall when an inside user pings to an outside host. The other types of ICMP status messages might be hostile and the firewall blocks all other ICMP messages.

Another option is to configure icmp inspection. This allows a trusted IP address to traverse the firewall and allows replies back to the trusted address only. This way, all inside interfaces can ping outside and the firewall allows the replies to return. This also gives you the advantage of monitoring the ICMP traffic that traverses the firewall.

For example:

policy-map global_policy
    class inspection_default
     inspect icmp

A. It can be an authentication issue. Verify that the IP phone user group has authentication (X-auth) enabled.

A. No. Load balancing must be handled by a router that passes traffic to the security appliance.

A. No.

A. Unfortunately, the PIX/ASA is not able to block the skype traffic. Skype has the capacity to negotiate dynamic ports and to use encrypted traffic. With encrypted traffic, it is virtually impossible to detect it as there are no patterns to look for.

You could eventually use a Cisco IPS (Intrusion Prevention System). It has some signatures that are able to detect a Windows Skype Client that connects to the Skype server to synchronize its version. This is usually done when the client is initiated the connection. When the sensor picks up the initial Skype connection, you can be able to find the person who use the service, and block all connections initiated from their IP address.

A. Yes. Cisco ASA Software Release 8.2 supports Simple Network Management Protocol (SNMP) version 3, the newest version of SNMP, and adds authentication and privacy options in order to secure protocol operations.

A. Use the names command in order to enable the association of a name with an IP address. You can associate only one name with an IP address. You must first use the names command before you use the name command. Use the name command immediately after you use the names command and before you use the write memory command.

The name command allows you to identify a host by a text name and map text strings to IP addresses. Use the clear configure name command in order to clear the list of names from the configuration. Use the no names command in order to disable logging name values. Both the name and names commands are saved in the configuration.

A. No.

A. Yes. In an AYT scenario, a remote user has a personal firewall installed on the PC. The VPN Client enforces the firewall policy defined on the local firewall, and it monitors that firewall to make sure that is runs. If the firewall stops running, the VPN Client drops the connection to the PIX or ASA. This firewall enforcement mechanism is called Are You There (AYT), because the VPN Client monitors the firewall by sending it periodic "are you there?" messages. If no reply comes, the VPN Client knows the firewall is down and terminates its connection to the PIX Security Appliance. The network administrator might configure these PC firewalls originally, but with this approach, users can customize their own configurations.

A. No. In a typical FTP connection, either the client or the server must tell the other what port to use for data transfer. The PIX is able to inspect this conversation and open that port. However, with FTP with TLS/SSL, this conversation is encrypted and the PIX is unable to determine what ports to open. Thus, the FTP with TLS/SSL connection ultimately fails.

One possible workaround in this situation is to use an FTP client that supports the use of a "clear command channel" while still using TLS/SSL to encrypt the data channel. With this option enabled, the PIX should be able to determine what port needs to be opened.

A. No, but it is supported in the Cisco 5500 Series Adaptive Security Appliance (ASA).

A. No, it is supported only in the Cisco 5500 Series Adaptive Security Appliance (ASA).

A. No.

A. No.

A. ASA does not support password management with NT.

Note: Security appliance supports password management for the RADIUS and LDAP protocols.

A. No. Easy VPN client configuration is only supported on ASA 5505.

A. ASA supports Asymmetric routing in version 8.2(1) and later. It is not supported in ASA versions prior to 8.2(1).

A. No.

A. Only IPsec Encapsulating Security Payload (ESP) encryption and authentication is supported. Authentication Header (AH) transforms are not supported on the ASA/PIX versions 7.0 and later.

A. No, ASA does not support Universal Plug and Play (UPnP) feature as of now.

A. If ASA 5505 uses EasyVPN for remote users (Client mode), failover works, but if you have the ASA configured to use it with Easy VPN Client (Network-Extension Mode-NEM mode), then it does not work when Failover is configured. So Failover works only when ASA uses EZVPN for remote users (Client mode), and so this errror occurs.

A. When you attempt to upgrade the AIP-SSM with the FTP, it can timeout. Increase the FTP Timeout value in order to resolve the issue.

For Example :

configure terminal
service host
network-settings
ftp-timeout 2700
exit

Save Changes.

A. The ASA does not support password management when you use LOCAL (internal) authentication. Remove the password management if configured in order to resolve this issue.

A. Format the flash or FSCK command in ASA/PIX in order to resolve this issue.

A. ASDM is not compatible with Java 6 update 10/11, so downgrade to Java 6 Update 7 with which ASDM works fine.

A. No.

A. No.

A. This error can occur while you use the threat detection feature in ASDM. Either use CLI to send the command or downgrade the ASDM in order to resolve this issue.

A. No, EXEC Authorization feature is not supported in ASA.

A. Reformat the flash in order to resolve this issue. If this does not resolve the issue then contact TAC for further assistance.

A. No.