PIX 515

[routeconfig]

Hi,

I am new to PIX firewall. Some questions:
1. Our PIX 515 has 2 interfaces.Can I add NIC card? If yes which make/model. This PIX is used for our testing purposes only.
2. How can I know "how many user license this PIX have"?The "sh ver" tells me its "unlimited", since I upgrade to 6.2.1.
3. Does license reflect to no. of connections? It confusing to me since "global" can limit my outgoing connections.
Thanks

John

 

[yizhar]

HI.

1. Our PIX 515 has 2 interfaces.Can I add NIC card?
An Intel PCI NIC can do the job, but not all models.
The newer models with 82550 are not compatible.
The older models with 82559 are fine.
You probably have the PIX 515R - This version supports up to 3 interface (including 2 built in), so you can only add 1 additional NIC.

2. How can I know "how many user license this PIX have?
Only the pix 501 model has a user limit.
Other models have no such limit, only a limit of concurrent sessions which is quite a high limit in the pix 515. You probably won't reach it unless you have many many users in that lab.

3. Does license reflect to no. of connections?
Well, the PIX515UR unlike the PIX515R comes with more RAM, so it can support more connections, but I think that this is only a hardware and not license limit (I'm not sure about this).

It confusing to me since "global" can limit my outgoing connection ???
Ah? What do you mean??
Do you mean the last 2 parameters of the NAT and the STATIC commands - max_conns & em_limit?
I guess these are for protection agains SYN flood and other DOS attacks.
Anyway read here about GLOBAL, NAT, STATIC and other commands:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_61/cmd_ref/index.htm

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[routeconfig]

Thanks Yizhar.
I found that PIX sends Syslog messages,except for "interface status" changing (manualy shutting down outside interface). PIX is configgured for
#logging trap debugging
Is there anything missing here?

John

 

[yizhar]

HI.
I did not notices this, but what happens if you pull out the Ethernet cable?
Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[routeconfig]

Interface line protocol shows "DOWN"

I did not see following features in PIX.
1. copy flash to tftp
2.boot from tftp server

Is there any way to achieve this?

 

[yizhar]

HI.

1. copy flash to tftp
The "write net ..." command can copy the configuration to tftp. I don't know about copying the OS image but you can look for the "copy" command options.

2.boot from tftp server
I don't think that the pix supports this, nor will it in the future. It seems to me logical that a firewall can only boot localy.

Bye

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar