enable PDM and config - new setup with v6.01

[trent1980]

i'm trying to setup pdm on my pix. i'm allowing my syslog server to access it (192.168.100.20). when i hit the ip address of the internal interface of the pix, it asks to authenticate and then give me an error "404 - page not found". it is authenticating with enable password .. here are my configs, am i missing any lines for the PDM to work?



###########################
PIX Version 6.0(1)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password **** encrypted
passwd **** encrypted
hostname pix
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
pager lines 24
logging on
logging timestamp
logging trap debugging
logging history debugging
logging facility 23
logging host inside 192.168.100.20
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside **** 255.255.255.0
ip address inside 192.168.100.107 255.255.255.0
ip address dmz 192.168.255.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address dmz 0.0.0.0
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 **** netmask 255.255.255.0
global (outside) 1 **** netmask 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
nat (dmz) 1 0.0.0.0 0.0.0.0 0 0
apply (outside) 101 outgoing_src
apply (inside) 101 outgoing_src
apply (outside) 101 outgoing_dest
apply (inside) 101 outgoing_dest
rip outside passive version 1
rip inside passive version 1
route outside 0.0.0.0 0.0.0.0 **** 1
route inside 192.168.101.0 255.255.255.0 192.168.100.1 1
route inside 192.168.102.0 255.255.255.0 192.168.100.200 1
route inside 192.168.103.0 255.255.255.0 192.168.100.1 1
route inside 192.168.105.0 255.255.255.0 192.168.100.1 1
timeout xlate 2:00:00
timeout conn 1:30:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
url-cache src_dst 128KB
http server enable
http 192.168.100.20 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
no floodguard enable
no sysopt route dnat
telnet 192.168.100.0 255.255.255.0 inside
telnet 192.168.100.0 255.255.255.0 dmz
telnet timeout 5
ssh timeout 5
terminal width 80

#############################


thanks,
Trent

 

[tbissett]

There could be a couple of problems:

1) First off, do a "show ver" and verify that at least the DES option is enabled in your license. If it is not, you'll need to obtain a free DES license from Cisco before using the PDM. 3DES is OK too.

2) Assuming that DES is enabled, do a "show ca mypubkey rsa." If you do not see anything there, you will need to create an encryption key. First make sure your clock is right, and verify that you have specified a domain name with the "domain-name" command. Then, issue the following commands in config mode:
ca generate rsa key 1024
ca save all

Give it a try.

 

[trent1980]

first of all, thanks for the response --

sho ver -
###########################################
Cisco Secure PIX Firewall Version 6.0(1)

Compiled on Thu 17-May-01 20:05 by morlee

pix up 15 days 17 hours

Hardware: AL440LX, 32 MB RAM, CPU Pentium II 233 MHz
Flash i28F640J5 @ 0x300, 16MB
BIOS Flash AT29C257 @ 0xfffd8000, 32KB

0: ethernet0: address is *, irq 11
1: ethernet1: address is *, irq 15
2: ethernet2: address is *, irq 10

Licensed Features:
Failover: Enabled
VPN-DES: Enabled
VPN-3DES: Disabled
Maximum Interfaces: 6
Cut-through Proxy: Enabled
Guards: Enabled
Websense: Enabled
Throughput: Unlimited
ISAKMP peers: Unlimited
###########################################


sho ca mypubkey rsa -
#########################################
pix# show ca mypubkey rsa

% Key pair was generated at: 07:26:56 Mar 04 2003

Key name: pix.ciscopix.com
Usage: General Purpose Key
Key Data: **** **** **** **** **** (real)
##########################################


** Here's the thing, It actually prompts me for a username and password and then authenticates it. In the cisco notes, it's supposed to next prompt to accept another certificate from VeriSign, but i never get that... it just "404 - page not found" on me.

got any other advice?

 

[yizhar]

HI.

You don't have PDM installed on your PIX.
Contact your Cisco dealer to obtain PDM.

You are also using an obsolute command "apply", and without matching "outbound" statemtns.
You should remove those "apply" statements, and if needed use "access-list" instead.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar