topic Re: PIX 515 Help in Network Security

PIX 515 Help

harrisgirls — Mon, 11 Mar 2019 20:07:54 GMT

Hello,

I've just got my hands on a Cisco PIX 515.

I mainly brought it too learn and play with, i done some cisco stuff in the past but not much.

I just need too get this up and running with a IP Address on ethernet1 (192.168.1.254) but when I run the command "nameif ethernet1 inside security100" in enable mode all I keep getting is ERROR % Invaild input detected at '' maker.

Any help would be great!

Re: PIX 515 Help

PAUL GILBERT ARIAS — Wed, 16 Mar 2011 19:02:22 GMT

you need to get into config mode. Get first in enable mode and then type "config t"

Re: PIX 515 Help

harrisgirls — Wed, 16 Mar 2011 19:05:56 GMT

nope, still get the same

cisco# conf t

cisco (config)# nameif ethernet0 outside security0

cisco (config)# ERROR: % Invaild input detected at ' ' maker.

it points too the "i" in nameif

Re: PIX 515 Help

PAUL GILBERT ARIAS — Wed, 16 Mar 2011 19:10:53 GMT

follow the following example:

Get into config mode first:

interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
ip address outside 10.165.200.225 255.255.255.224

ip address inside 10.1.1.1 255.255.255.0

Re: PIX 515 Help

harrisgirls — Wed, 16 Mar 2011 19:14:55 GMT

Sorry

cisco (config)# interface ethernet0 auto

ERROR: % Invaild input detected at " " maker

pointing too the a in auto.

just too note this is from factory defaults, do the interfaces have to be enabled?

Re: PIX 515 Help

PAUL GILBERT ARIAS — Wed, 16 Mar 2011 19:20:59 GMT

can you type "interface ethernet0 ?" the question mark is to check the options available after the command ethernet0.

By the way can you do "show version" and tell me what version you have on the pix?

Here is the command reference for version 6.3:

http://www.cisco.com/en/US/docs/security/pix/pix63/command/reference/gl.html#wp1075586

Re: PIX 515 Help

harrisgirls — Wed, 16 Mar 2011 19:23:13 GMT

wwn-fw-01(config)# show conf
: Saved
: Written by enable_15 at 18:36:30.982 UTC Wed Mar 16 2011
!
PIX Version 8.0(4)
!
hostname wwn-fw-01
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet1
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
pager lines 24
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
   message-length maximum 512
policy-map global_policy
class inspection_default
   inspect dns preset_dns_map
   inspect ftp
   inspect h323 h225
   inspect h323 ras
   inspect rsh
   inspect rtsp
   inspect esmtp
   inspect sqlnet
   inspect skinny
   inspect sunrpc
   inspect xdmcp
   inspect sip
   inspect netbios
   inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:1c24573f3dd386306af40cc1f2384164
wwn-fw-01(config)#

Re: PIX 515 Help

PAUL GILBERT ARIAS — Wed, 16 Mar 2011 19:27:39 GMT

I see the problem here, you are running version 8.0. It is totally different. If you want to configure the interface I will be similar to a router, for example:

interface Ethernet1
no shutdown
nameif inside
security-level 100
ip address 10.10.10.1 255.255.255.0

interface Ethernet0
no shutdown
nameif outside
security-level 0
ip address 192.168.1.1 255.255.255.0

Re: PIX 515 Help

PAUL GILBERT ARIAS — Wed, 16 Mar 2011 19:34:32 GMT

Here is the configuration guide for this version:

http://www.cisco.com/en/US/partner/docs/security/asa/asa80/configuration/guide/conf_gd.html

Re: PIX 515 Help

harrisgirls — Wed, 16 Mar 2011 19:42:09 GMT

Link doesnt work:

Forbidden File or Application

them commands worked.

do you know how I can enable the http so I can get onto the PDM?

Re: PIX 515 Help

harrisgirls — Wed, 16 Mar 2011 19:46:32 GMT

I've set the IP for inside but I cant ping it at all

Re: PIX 515 Help

PAUL GILBERT ARIAS — Wed, 16 Mar 2011 19:47:54 GMT

glad to hear the commands worked. In order to enable the WEB interface you need the following commands:

http server enable

http 0 0 inside

That will enable the ASDM (new name for version 7.X and higher).

Make sure the ASDM is installed on your PIX. The show version will show you if the Adaptive Security Device Manager is there. you can also check if you have in your flash by using the command "show flash"

Re: PIX 515 Help

harrisgirls — Wed, 16 Mar 2011 19:51:39 GMT

http server enable and http 0 0 inside and done!

still cant ping the inside address which I asume i wont be able too get too the PDM

Show flash indicates I have asdm-61551.bin

Re: PIX 515 Help

PAUL GILBERT ARIAS — Wed, 16 Mar 2011 19:52:04 GMT

what is your IP and what is the interface IP of the PIX? Are you connected to the same interface of the PIX?

What is the status of the interface? Please send the show interface

Re: PIX 515 Help

harrisgirls — Wed, 16 Mar 2011 19:56:41 GMT

wwn-fw-01(config)# show interface
Interface Ethernet0 "outside", is down, line protocol is down
   Hardware is i82559, BW 100 Mbps, DLY 100 usec
         Auto-Duplex, Auto-Speed
         MAC address 0003.6bf6.ffaa, MTU 1500
         IP address 10.10.10.1, subnet mask 255.255.255.0
         0 packets input, 0 bytes, 0 no buffer
         Received 0 broadcasts, 0 runts, 0 giants
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
         0 L2 decode drops
         0 packets output, 0 bytes, 0 underruns
         0 output errors, 0 collisions, 0 interface resets
         0 babbles, 0 late collisions, 0 deferred
         0 lost carrier, 0 no carrier
         input queue (curr/max packets): hardware (0/0) software (0/0)
         output queue (curr/max packets): hardware (0/0) software (0/0)
   Traffic Statistics for "outside":
         0 packets input, 0 bytes
         0 packets output, 0 bytes
         0 packets dropped
       1 minute input rate 0 pkts/sec, 0 bytes/sec
       1 minute output rate 0 pkts/sec, 0 bytes/sec
       1 minute drop rate, 0 pkts/sec
       5 minute input rate 0 pkts/sec, 0 bytes/sec
       5 minute output rate 0 pkts/sec, 0 bytes/sec
       5 minute drop rate, 0 pkts/sec
Interface Ethernet1 "inside", is administratively down, line protocol is up
   Hardware is i82559, BW 100 Mbps, DLY 100 usec
         Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
         MAC address 0003.6bf6.ffab, MTU 1500
         IP address 192.168.1.250, subnet mask 255.255.255.0
         115 packets input, 0 bytes, 0 no buffer
         Received 0 broadcasts, 0 runts, 0 giants
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
         0 L2 decode drops
         0 packets output, 0 bytes, 0 underruns
         0 output errors, 0 collisions, 0 interface resets
         0 babbles, 0 late collisions, 0 deferred
         0 lost carrier, 0 no carrier
         input queue (curr/max packets): hardware (0/0) software (0/0)
         output queue (curr/max packets): hardware (1/0) software (0/0)
   Traffic Statistics for "inside":
         0 packets input, 0 bytes
         0 packets output, 0 bytes
         0 packets dropped
       1 minute input rate 0 pkts/sec, 0 bytes/sec
       1 minute output rate 0 pkts/sec, 0 bytes/sec
       1 minute drop rate, 0 pkts/sec
       5 minute input rate 0 pkts/sec, 0 bytes/sec
       5 minute output rate 0 pkts/sec, 0 bytes/sec
       5 minute drop rate, 0 pkts/sec
Interface Virtual254 "", is up, line protocol is up
   Hardware is Virtual   Available but not configured via nameif
         MAC address 0000.0000.0000, MTU not set
         IP address unassigned
wwn-fw-01(config)#

Re: PIX 515 Help

PAUL GILBERT ARIAS — Wed, 16 Mar 2011 20:01:02 GMT

both interfaces are down. You are connecting to which interface?

The inside interface is admin down so you missed the command "no shutdown" inside the interface you called inside.

Also you need the command "asdm image flash:asdm-61551.bin"

The outside interface is down so I guess you have nothing connected to it.

Re: PIX 515 Help

harrisgirls — Wed, 16 Mar 2011 20:02:52 GMT

I am connected too ethernet1 (192.168.1.250)

Re: PIX 515 Help

PAUL GILBERT ARIAS — Wed, 16 Mar 2011 20:04:04 GMT

ok good. that is the interface that needs the command "no shutdown"

interface e1

no shutdown

exit

write memory

Re: PIX 515 Help

harrisgirls — Wed, 16 Mar 2011 20:04:18 GMT

i've applied command no shutdown and the interface has come up

Re: PIX 515 Help

harrisgirls — Wed, 16 Mar 2011 20:06:25 GMT

Okay thank you.

I am going too see if I can configure this from PDM now............

So I may be back!