PIX 515 Help

[harrisgirls]

Hello,

I've just got my hands on a Cisco PIX 515.

I mainly brought it too learn and play with, i done some cisco stuff in the past but not much.

I just need too get this up and running with a IP Address on ethernet1 (192.168.1.254) but when I run the command "nameif ethernet1 inside security100" in enable mode all I keep getting is ERROR % Invaild input detected at '' maker.

Any help would be great!

[PAUL GILBERT ARIAS]

you need to get into config mode. Get first in enable mode and then type "config t"

[harrisgirls]

nope, still get the same

cisco# conf t

cisco (config)# nameif ethernet0 outside security0

cisco (config)# ERROR: % Invaild input detected at ' ' maker.

it points too the "i" in nameif

[PAUL GILBERT ARIAS]

follow the following example:

Get into config mode first:

interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
ip address outside 10.165.200.225 255.255.255.224

ip address inside 10.1.1.1 255.255.255.0

[harrisgirls]

Sorry

cisco (config)# interface ethernet0 auto

ERROR: % Invaild input detected at " " maker

pointing too the a in auto.

just too note this is from factory defaults, do the interfaces have to be enabled?

[PAUL GILBERT ARIAS]

can you type "interface ethernet0 ?" the question mark is to check the options available after the command ethernet0.

By the way can you do "show version" and tell me what version you have on the pix?

Here is the command reference for version 6.3:

http://www.cisco.com/en/US/docs/security/pix/pix63/command/reference/gl.html#wp1075586

[harrisgirls]

wwn-fw-01(config)# show conf
: Saved
: Written by enable_15 at 18:36:30.982 UTC Wed Mar 16 2011
!
PIX Version 8.0(4)
!
hostname wwn-fw-01
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0
  shutdown
  no nameif
  no security-level
  no ip address
!
interface Ethernet1
  shutdown
  no nameif
  no security-level
  no ip address
!
ftp mode passive
pager lines 24
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
  match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
  parameters
   message-length maximum 512
policy-map global_policy
  class inspection_default
   inspect dns preset_dns_map
   inspect ftp
   inspect h323 h225
   inspect h323 ras
   inspect rsh
   inspect rtsp
   inspect esmtp
   inspect sqlnet
   inspect skinny
   inspect sunrpc
   inspect xdmcp
   inspect sip
   inspect netbios
   inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:1c24573f3dd386306af40cc1f2384164
wwn-fw-01(config)#

[PAUL GILBERT ARIAS]

I see the problem here, you are running version 8.0. It is totally different. If you want to configure the interface I will be similar to a router, for example:

interface Ethernet1
  no shutdown
  nameif inside
  security-level 100
  ip address 10.10.10.1 255.255.255.0

interface Ethernet0
  no shutdown
  nameif outside
  security-level 0
  ip address 192.168.1.1 255.255.255.0

[PAUL GILBERT ARIAS]

Here is the configuration guide for this version:

http://www.cisco.com/en/US/partner/docs/security/asa/asa80/configuration/guide/conf_gd.html

[harrisgirls]

Link doesnt work:

Forbidden File or Application

them commands worked.

do you know how I can enable the http so I can get onto the PDM?

[harrisgirls]

I've set the IP for inside but I cant ping it at all

[PAUL GILBERT ARIAS]

what is your IP and what is the interface IP of the PIX? Are you connected to the same interface of the PIX?

What is the status of the interface? Please send the show interface

[PAUL GILBERT ARIAS]

glad to hear the commands worked. In order to enable the WEB interface you need the following commands:

http server enable

http 0 0 inside

That will enable the ASDM (new name for version 7.X and higher).

Make sure the ASDM is installed on your PIX. The show version will show you if the Adaptive Security Device Manager is there. you can also check if you have in your flash by using the command "show flash"

[harrisgirls]

http server enable and http 0 0 inside and done!

still cant ping the inside address which I asume i wont be able too get too the PDM

Show flash indicates I have asdm-61551.bin

[harrisgirls]

wwn-fw-01(config)# show interface
Interface Ethernet0 "outside", is down, line protocol is down
   Hardware is i82559, BW 100 Mbps, DLY 100 usec
         Auto-Duplex, Auto-Speed
         MAC address 0003.6bf6.ffaa, MTU 1500
         IP address 10.10.10.1, subnet mask 255.255.255.0
         0 packets input, 0 bytes, 0 no buffer
         Received 0 broadcasts, 0 runts, 0 giants
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
         0 L2 decode drops
         0 packets output, 0 bytes, 0 underruns
         0 output errors, 0 collisions, 0 interface resets
         0 babbles, 0 late collisions, 0 deferred
         0 lost carrier, 0 no carrier
         input queue (curr/max packets): hardware (0/0) software (0/0)
         output queue (curr/max packets): hardware (0/0) software (0/0)
   Traffic Statistics for "outside":
         0 packets input, 0 bytes
         0 packets output, 0 bytes
         0 packets dropped
       1 minute input rate 0 pkts/sec,  0 bytes/sec
       1 minute output rate 0 pkts/sec,  0 bytes/sec
       1 minute drop rate, 0 pkts/sec
       5 minute input rate 0 pkts/sec,  0 bytes/sec
       5 minute output rate 0 pkts/sec,  0 bytes/sec
       5 minute drop rate, 0 pkts/sec
Interface Ethernet1 "inside", is administratively down, line protocol is up
   Hardware is i82559, BW 100 Mbps, DLY 100 usec
         Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
         MAC address 0003.6bf6.ffab, MTU 1500
         IP address 192.168.1.250, subnet mask 255.255.255.0
         115 packets input, 0 bytes, 0 no buffer
         Received 0 broadcasts, 0 runts, 0 giants
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
         0 L2 decode drops
         0 packets output, 0 bytes, 0 underruns
         0 output errors, 0 collisions, 0 interface resets
         0 babbles, 0 late collisions, 0 deferred
         0 lost carrier, 0 no carrier
         input queue (curr/max packets): hardware (0/0) software (0/0)
         output queue (curr/max packets): hardware (1/0) software (0/0)
   Traffic Statistics for "inside":
         0 packets input, 0 bytes
         0 packets output, 0 bytes
         0 packets dropped
       1 minute input rate 0 pkts/sec,  0 bytes/sec
       1 minute output rate 0 pkts/sec,  0 bytes/sec
       1 minute drop rate, 0 pkts/sec
       5 minute input rate 0 pkts/sec,  0 bytes/sec
       5 minute output rate 0 pkts/sec,  0 bytes/sec
       5 minute drop rate, 0 pkts/sec
Interface Virtual254 "", is up, line protocol is up
   Hardware is Virtual   Available but not configured via nameif
         MAC address 0000.0000.0000, MTU not set
         IP address unassigned
wwn-fw-01(config)#