CLI vs. PDM

[milanvng]

I have been using PIX with command line for some time now.

Since recently we upgraded to 6.3(3), I have been asked to use the PDM.

Does anyone has comments using PDM? In addition, I was told that PDM adds additional config lines.

If I wanted to use CLI with PDM would there be a problem?

[aacole]

I've recently run some courses on the PIX, I start by using the CLI and then introduce the PDM. I can guarantee that every time I do this virtually all the students experience various connection problems, as the PDM adds new ACL's or overwrites part of the existing configuration. Whilst this is provides great fun in the classroom for debugging, its very frustrating for a serious user.

Based on this experience I'd use one or the other, not try to use both. That said, the PDM does offer some very useful monitoring features, how about use it in that mode only?

Andy

[jonathanstevens]

I would tend to agree.

Although I do find the PDM usefull for setting up a "base" configuration on new boxes, and the VPN wizard is pretty nifty.

However, as a rule I use the PDM for quick monitoring and the CLI for change. Also, if you are using a proper change control system, you can pre-script you change for approval and keep a much better log of changes if you use the CLI.

[milanvng]

Andy / Jonathan,

Thanks for the reply.

I will definitely use only the command line, which I am comfortable with anyway. (I was asked to use the PDM because there are also some Checkpoint guys who are not familiar with PIX’s CLI.)

I just started using the PDM's monitoring feature, which looks great.

Thanks again.