Problem using PDM with Cisco pix 506e 1

[ScottWIT]

We have a remote location that just setup and configured a Cisco pix 506e. I need to occasionally get in and make changes to it so I want to use the PDM for that. They gave access to my public IP but I cannot get into it. It will take the username and password and get all the way to that point but then it just hangs there in the PDM window. So if I can get that far is that issue on my end?? I upgraded to IE 7.0 and checked to make sure I have the latest version of Java installed. Also tried with Firefox but no luck. I can however access it via SSH. I would much prefer the PDM though. Any thoughts on where the problem is?

 

[kmills]

ScottWIT,
You might try posting to the Cisco Systems: Pix Firewall forum under MIS/IT for answers to your question.

kmills

 

[burtsbees]

Can they access it via PDM locally using the same credentials?

Burt

 

[ScottWIT]

yes, i believe they can access it from there just fine.

 

[burtsbees]

What is doing the NATting? Can you post a config of the edge device?

Burt

 

[ScottWIT]

of the pix 506? here it is.... had to disguise some info for obvious reasons:



Building configuration...
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password **********/ encrypted
passwd **********/ encrypted
hostname *********
domain-name ********.com
no fixup protocol dns
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list 102 permit icmp any any
access-list 102 permit tcp any any eq ssh
access-list 101 permit ip any host ************
access-list 101 permit ip any host ************
access-list 101 permit tcp any any eq domain
access-list 101 permit tcp any any eq www
access-list 101 permit tcp any any eq 8000
access-list 101 permit udp any any eq isakmp
access-list 101 permit udp any any eq 4500
access-list 101 permit tcp any any eq ftp
access-list 101 permit tcp any any eq ssh
access-list 101 permit tcp any any eq https
access-list 101 permit tcp any any eq ftp-data
access-list 101 permit tcp any any eq smtp
access-list 101 permit tcp any any eq pop3
access-list 101 permit tcp any any eq 5050
access-list 101 permit tcp any any eq 5222
access-list 101 permit icmp any any
access-list 101 permit tcp any any eq 8080
access-list 101 permit tcp any any eq 4999
access-list 101 deny ip any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside ********** 255.255.255.252
ip address inside *********** 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location *********** 255.255.255.255 inside
pdm location (MY PUBLIC IP ADDRESS HERE) 255.255.255.255 outside
pdm location *********** 255.255.255.255 outside
pdm location *********** 255.255.255.255 outside
pdm location *********** 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group 102 in interface outside
access-group 101 in interface inside
route outside 0.0.0.0 0.0.0.0 *********** 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 outside
http *********** 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet ************ 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 60
console timeout 0
dhcpd address ***********-*********** inside
dhcpd dns ************* ***************
dhcpd lease 259200
dhcpd ping_timeout 750
dhcpd enable inside
username ****** password ************ encrypted privilege 2
username ***** password *********** encrypted privilege 15
username ***** password *********** encrypted privilege 2
terminal width 80
Cryptochecksum:***************************
: end
[OK]

 

[burtsbees]

Another test...what happens when you enter said public IP address into your browser?

http://x.x.x.x

Burt

 

[ScottWIT]

ok, problem solved. my version of java (1.6.0) was too new and wouldn't work with the version of PDM they had. so i went with java 1.5.0 instead and it works fine now.

 

[burtsbees]

Good deal.

Burt

 

[ADB100]

I have Java 1.6 and don't have any issues accessing PDM on a few 501's running 6.3(5)?

Andy

 

[burtsbees]

Naturally, the next step would be to find a common denominator between your two situations, I.E. browser, OS, OS updates, and possibly even hardware (graphics) to see exactly what the solution could be...Andy, in some cases, you must admit that after troubleshooting this and that, when it finally works but you don't know EXACTLY why, screw it---it's fixed! However, it's easier to work and troubleshoot backwards...hindsight is 20/20...

Burt

 

[ADB100]

I have two PC's, one running Windows 2003 Enterprise Server SP2 with IE7 and Java 1.6, the other is running Windows XP SP2, IE7 and Java 1.6. Both are patched up with Windows Updates and Java using the update option. Both PIX 501's are running 6.3(5) with the 3DES/AES license. Both have enrolled for certificates from a Windows 2003 Enterprise Server CA using a modified IPSec (Offline Request) Certificate Template to include Server Authentication. Without this the default IPSec (Offline Request) Certificate Template isn't enough for IE to accept it. I previously used a self-signed certificate on the PIX's and the behaviour was the same.

I have occasional issues with Java 1.6 in that it throws up a dialogue box saying there was some issue with loading multiple VMs.

I can't think of anything else that is unique?

Andy

 

[burtsbees]

Yeah---what's strange is that everyone could access his PIX via PDM from within the network just fine, but from the WAN side is when he would have problems...

Burt

 

[ScottWIT]

well, in my situation i upgraded from IE 6 to IE 7 and still had issues (XP SP 2). i called cisco and suggested the problem might be my version of java. they said this was a fairly common issue with this particular PDM version. i was skeptical but they turned out to be right on the money.
i am not sure what version of java they are running where the pix is located.