Cisco PIX 500 Series Security Appliances

The document addresses the most frequently asked questions (FAQs) related to Cisco Security Appliances like PIX 500 Series and ASA 5500 Series..

The target audience for this document is a security appliance administrator who understands CLI commands and features, and has experience with the configuration of earlier PIX software versions.

A. PIX 515, PIX 515E, PIX 525, PIX 535 and all of the Cisco ASA 5500 Series Adaptive Security Appliances (ASA 5510, ASA 5520, and ASA 5540) support software version 7.x.

The PIX 501, PIX 506E, and PIX 520 Security Appliances are not supported in software version 7.x.

A. The PIX Security Appliance can operate in two different firewall modes:

1. Routed mode—In routed mode, the PIX has IP addresses assigned to its interfaces and acts as a router hop for packets that pass through it. All traffic inspection and forwarding decisions are based on Layer 3 parameters. This is how PIX Firewall versions earlier than 7.0 operate.

2. Transparent mode—In transparent mode the PIX does not have IP addresses assigned to its interfaces. Instead it acts as a Layer 2 bridge that maintains a MAC address table and makes forwarding decisions based on that. The use of full extended IP access lists is still available and the firewall can inspect IP activity at any layer. In this mode of operation the PIX is often referred to as a "bump in the wire" or "stealth firewall". There are other significant differences as to how transparent mode operates in comparison to routed mode:

   • Only two interfaces are supported—inside and outside

   • NAT is not supported or required since the PIX is no longer a hop.

Note: Because transparent and routed modes use different approaches to security, the running configuration is cleared when the PIX is switched to transparent mode. Be sure to save your routed mode running configuration to Flash or an external server.

A. You can partition a single hardware PIX into multiple virtual devices, known as Security Contexts. Each context becomes an independent device, with its own security policy, interfaces, and administrators. Multiple contexts are similar to having multiple standalone devices. Many features are supported in multiple context mode and include routing tables, firewall features, IPS, and management. Some features are not supported, including VPN and dynamic routing protocols.

A. PIX 7.0 has three times more syslogs and new features than the 6.x versions. Increased CPU usage compared to 6.x is normal.

A. There are two options in PIX 7.x that allow inside users to ping outside. The first option is to setup a specific rule for each type of echo message. For example:

access-list 101 permit icmp any any echo-reply
        access-list 101 permit icmp any any source-quench 
        access-list 101 permit icmp any any unreachable  
        access-list 101 permit icmp any any time-exceeded
        access-group 101 in interface outside

This allows only these return messages through the firewall when an inside user pings to an outside host. The other types of ICMP status messages might be hostile and the firewall blocks all other ICMP messages.

Another option is to configure icmp inspection. This allows a trusted IP address to traverse the firewall and allows replies back to the trusted address only. This way, all inside interfaces can ping outside and the firewall allows the replies to return. This also gives you the advantage of monitoring the ICMP traffic that traverses the firewall.

For example:

policy-map global_policy
    class inspection_default
     inspect icmp

A. Use the names command in order to enable the association of a name with an IP address. You can associate only one name with an IP address. You must first use the names command before you use the name command. Use the name command immediately after you use the names command and before you use the write memory command.

The name command allows you to identify a host by a text name and map text strings to IP addresses. Use the clear configure name command in order to clear the list of names from the configuration. Use the no names command in order to disable logging name values. Both the name and names commands are saved in the configuration.

A. No.

A. Yes. In an AYT scenario, a remote user has a personal firewall installed on the PC. The VPN Client enforces the firewall policy defined on the local firewall, and it monitors that firewall to make sure that is runs. If the firewall stops running, the VPN Client drops the connection to the PIX or ASA. This firewall enforcement mechanism is called Are You There (AYT), because the VPN Client monitors the firewall by sending it periodic "are you there?" messages. If no reply comes, the VPN Client knows the firewall is down and terminates its connection to the PIX Security Appliance. The network administrator might configure these PC firewalls originally, but with this approach, users can customize their own configurations.

A. No. In a typical FTP connection, either the client or the server must tell the other what port to use for data transfer. The PIX is able to inspect this conversation and open that port. However, with FTP with TLS/SSL, this conversation is encrypted and the PIX is unable to determine what ports to open. Thus, the FTP with TLS/SSL connection ultimately fails.

One possible workaround in this situation is to use an FTP client that supports the use of a "clear comannd channel" while still using TLS/SSL to encrypt the data channel. With this option enabled, the PIX should be able to determine what port needs to be opened.

A. No.

A. No, but it is supported in the Cisco 5500 Series Adaptive Security Appliance (ASA).

A. No, it is supported only in the Cisco 5500 Series Adaptive Security Appliance (ASA).

A. No.

A. No.

A. ASA does not support password management with NT.

Note: Security appliance supports password management for the RADIUS and LDAP protocols.

A. Unfortunately, there is no way to do policy-based routing on the ASA at this time. It can be a feature that is added to the ASA in the future.

A. No. Easy VPN client configuration is only supported on ASA 5505.

A. No.

A. No.

A. Only IPsec Encapsulating Security Payload (ESP) encryption and authentication is supported. Authentication Header (AH) transforms are not supported on the ASA/PIX versions 7.0 and later.