Pix OS Upgrade

[LoopyLoo]

Guys,

It has been recommended that we upgrade our PIX firewalls from 5.1(2) to 5.1(4). Are there any issues associated with this? Any problems I should look out for? Should I consider going to the latest version of the PIX OS instead?

Any input would be greatly appreciated.

Loopy

 

[baddos]

Definately consider going to 6.2(2) if you can. There are a number of security vulnerabilities with the PIX that has been addressed since 5.1(4).

For the most part, every thing should work fine. Upgrade the PIX at night and do some testing. All the conduit and outbound commands still exist, even though they have been replaced by the access-list command.

You should consider using the access-lists over the conduits and outbounds if you haven't already. Access-lists are much faster.

 

[dopehead]

I Think i would stay away from 6.2(2), there are some really bad bugs in it, just go for 6.1(4) or 6.2(1) if you dare

 

[baddos]

I've been running 6.2(2) for three months now. Not one bug found.

 

[havanajoe]

I'm with baddos on this one, I have been running it for about 8 months (since it was introduced) and I haven't had any problems with it. I would recomend upgrading to this version and then once you are up and running take a copy of the config file and work on it with notepad and upgrade the conduits/outbound rules to access-lists.

 

[sfrank8734]

I'd be curious to hear anyones input on moving from 6.1(x) to 6.2(x) IF they are using multiple interfaces, site-to-site and client VPN, and failover. The failover stuff changes dramatically in 6.2 (no more serial cable, etc), and I'm not ready to leap like that in my environment!

 

[baddos]

In 6.2 you can use both the serial and the NIC method for failover. I have two 525 pixes and it's working great.

I did go w/ the ethernet failover though for the added benefits of the tcp connection failover.

-Bad Dos

 

[wybnormal]

We run 6.2 with serial failover and no problems. We jumped from 5.1 to 6.2 in one swoop.. Not really the way we wanted to but thats how it worked out.

MikeS
Find me at

http://www.packetattack.com

"Take advantage of the enemy's unreadiness, make your way by unexpected routes, and attack unguarded spots."
Sun Tzu