Feedback
Table Of Contents
Step 1 - Get the Most Current Software
If You Are Using Windows or MS-DOS
Step 2 - Get a Console Terminal
Step 3 - Configure Network Routing
Preparing Routers to Work with the PIX Firewall
Setting a Default Route for Each Host
Setting a Solaris or SunOS Default Route
Setting a Windows 95 and Windows 98 Default Route
Setting a Windows NT Default Route
Step 4 - Start Configuring PIX Firewall
Go to the PIX Firewall Configuration Mode
Step 5 - Identify Each Interface
Step 6 - Let Users Start Connections
Step 7 - Create a Default Route
Step 9 - Store the Image in Flash Memory and Reboot
Step 10 - Check the Configuration
Step 11 - Test Network Connectivity
Step 12 - Add Telnet Console Access
Configuring PIX Firewall to Send Syslog Messages
Configuring a UNIX System for Syslog
Step 17 - Add User Authentication
Step 18 - Recheck the Configuration
Configuring the PIX Firewall
You can configure the PIX Firewall by entering commands similar to those of Cisco IOS technology.
When shipped from Cisco, each PIX Firewall comes with a basic configuration that lets the unit boot up, but does not let network traffic pass through until you configure it to do so.
This chapter describes how to start a configuration and build on it. lists the topics in this chapter. The material is presented as a series of steps that you can follow completely if you are creating a new configuration, or as needed with an existing configuration.
Acronyms in this chapter are defined in Appendix B, "." All commands shown in this chapter are explained fully in Chapter 5, "."
If you are new to the PIX Firewall and have a Windows NT system, you can use the PIX Firewall Setup Wizard to simplify your initial configuration. Refer to Appendix C, "" for more information.
If you are upgrading, read the Release Notes for the PIX Firewall, which you can view online at:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v42/pixrn420.htm
Then save your configuration on diskette with the write floppy command. Additional upgrading information for the failover feature is described in the "Failover" section in Chapter 3, "."
Step 1 - Get the Most Current Software
If desired, you can obtain the most current version of the PIX Firewall software by downloading it from Cisco's online web or FTP site. If you are using FTP, refer to the section "Download with FTP." If you are using the Web, refer to the section "Download Over the Web." The sections that follow describe how to download the software and prepare a PIX Firewall bootable diskette. When the diskette is ready, you can insert it in the PIX Firewall's diskette drive and restart the firewall. This will give you access to the most current software on your PIX Firewall.
Download Over the Web
To download PIX Firewall software from the CCO web site:
Step 1
Use a network browser, such as Netscape Navigator to access http://www.cisco.com.
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
If you already have the rawrite program or are using a UNIX system, you can just copy the binary image file. The binary image filename ends with the .bin suffix. If you are using a Windows NT system, you can also download software for the PIX Firewall Manager GUI (graphical user interface) and the PIX Firewall Setup Wizard. The PIX Firewall Manager lets you manage from one to ten PIX Firewall units. The PIX Firewall Setup Wizard makes initial configuration of the PIX Firewall faster through a series of dialog screens that lead you through the configuration process.
Step 10
(a)
Choose the directory and file name and click Save. A dialog box appears to show you the progress of the transfer.
(b)
(c)
If you are using UNIX, proceed to the section "If You Are Using UNIX"; if you are using Windows or MS-DOS, proceed to the section "If You Are Using Windows or MS-DOS."
Download with FTP
Before using FTP, you need to have previously registered with Cisco, which you can do via the Web or by calling Cisco.
Set your FTP client for passive mode. If you are not running in passive mode, you can log in and view the Cisco presentation messages, but entering commands will cause your client to appear to suspend execution.
The Windows 95 and Windows NT command line FTP programs do not support passive mode.
To get the most current software with FTP:
Step 1
Step 2
Step 3
Step 4
http://www.adobe.com/prodindex/acrobat/readstep.html
Step 5
If You Are Using Windows or MS-DOS
Step 1
•
•
•
A sample archive extraction follows:
...extraction utility messages...Searching EXE: C:/PIX/PIX4nn.EXEInflating: README.TXTInflating: PIX4nn.BINInflating: RAWRITE.EXEStep 2
The rawrite program erases all the files on the diskette. If you format the diskette from Windows, choose the long version, not the quick format. The quick format does not adequately prepare the diskette for rawrite. The best way to format the diskette is from the MS-DOS command prompt.
Step 3
The utility then creates a PIX Firewall boot diskette.
A sample rawrite session follows:
C:\pix>rawriteRaWrite 1.2 - Write disk file to raw floppy disketteEnter source file name: pix4nn.binEnter destination drive: a:Please insert a formatted diskette into drive A: and press -ENTER- :Number of sectors per track for this disk is 18Writing image to drive A:. Press ^C to abort.Track: 31 Head: 1 Sector: 16Done.C:\pix>Step 4
To continue configuration, proceed to the "Step 2 - Get a Console Terminal" section.
If You Are Using UNIX
Step 1
Step 2
Step 3
# dd bs=18b if=./pix4nn.bin of=/dev/rfd0This command copies the binary file to the output device file with a block size of 18 blocks.
Note
Step 4
When done, continue your configuration with the "Step 3 - Configure Network Routing" section.
Step 2 - Get a Console Terminal
If the computer you are connecting to runs either Windows 95 or Windows NT, the Windows HyperTerminal accessory provides easy-to-use software for communicating with the firewall. If you are using UNIX, refer to your system documentation for a terminal program.
HyperTerminal also lets you cut and paste configuration information from your computer to the firewall console.
To configure HyperTerminal:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
•
•
•
•
•
Step 7
Step 8
If nothing happens, wait 60 seconds first. The firewall does not send information for about 30 seconds. If messages do not appear after 60 seconds, press the Enter key. If still nothing appears, ensure that the serial cable is attached to COM1 and not to COM2 if your computer is so equipped. If garbage characters appear, ensure that the bits per second setting is 9600.
Step 9
Step 10
HyperTerminal saves a log of your console session that you can access the next time you use it.
To restart HyperTerminal, double-click the connection name you chose in the HyperTerminal folder. When HyperTerminal starts, drag the scroll bar up to view the previous session.
Step 3 - Configure Network Routing
Read this section before configuring the PIX Firewall to help you make decisions for configuring network routing.
Routing directs the flow of packets through a network. A default route specifies to which router packets are sent when the address is not known.
A host sends a message to another user. If the computer itself does not contain a login account for the user, the computer sends the message to its default gateway router. A router stores the paths through the network known as routes. If a router does not have the route to the user in its storage, it passes the message to its default router which knows routes from the larger network. The message is checked against the routes in this router. If it is not found, it is sent to another router with a still larger view of the network. This process repeats with the message sent from one router to another until the message is sent to the correct destination.
Preparing Routers to Work with the PIX Firewall
Once you have configured the PIX Firewall, you need to configure the other devices that will interact with the PIX Firewall. The most important element that works with the PIX Firewall are the routers, or switches, if they have routing capability. The instructions that follow assume that the routers are from Cisco.
To prepare the routers to work with the PIX Firewall:
Step 1
Step 2
Step 3
Step 4
Step 5
ip route pix_inside_interface_ip_addressStep 6
Step 7
Step 8
Step 9
Step 10
Because the PIX Firewall is not a router, you need to specifically tell it where to route packets. The PIX Firewall lets you specify one default route to the outside interface, with one exception: if your PIX Firewall has only two interface cards installed (not 3 or 4 that are in the firewall, but not connected to cables), you can specify two default routes, one for the outside and one for the inside. For a PIX Firewall with 3 or more interfaces, only the outside default route is allowed.
In many networks, the interface connecting to the PIX Firewall connects to a router. Many times, a number of networks connect to the router. To ensure that the PIX Firewall can see these routes, you need to add static route statements for each network.
Both default and static routes are set on the PIX Firewall with the route command.
Setting a Default Route for Each Host
Each host on the same subnet as the inside or perimeter interfaces must have its default route pointing to the PIX Firewall.
Setting a Solaris or SunOS Default Route
If the host is a Solaris or SunOS workstation, you can determine the default route with this command:
netstat -nrWith root permissions, edit the /etc/defaultrouter file to point the default route at the PIX Firewall and then reboot the workstation so that the information is usable.
Setting a LINUX Default Route
On LINUX systems, use the netstat -r command to view the routing table including the default route.
With root permissions, use the following command to set the default route:
route add default gw IP_address_of_next_hostReplace IP_address_of_next_host with the IP address of the next host.
Setting a Windows 95 and Windows 98 Default Route
If the host is a Windows workstation, you can view the default route by selecting Start>Run and entering this command:
winipcfgTo change the default route, select Start>Settings>Control Panel and double-click the Network item.
Select the TCP/IP entry from the list of installed network components and click Properties. The default route is on the Gateway tab.
Setting a Windows NT Default Route
You can view the default route from the Command Prompt by entering the ipconfig command. You can access the Command Prompt by selecting Start>Programs>Command Prompt.
To change the default gateway in Windows NT:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Setting a MacOS Default Route
You can view the default route from the MacOS 7.5 and later from the Apple menu>Control Panels>TCP/IP window. You can also set the default route from this window.
Step 4 - Start Configuring PIX Firewall
Before continuing, view "Command Line Guidelines" in Chapter 1, "" for information on how to specify ports and protocols, terminology, and other useful PIX Firewall facts.
When you start your PIX Firewall for the first time or load a new PIX Firewall boot disk, the configuration comes with many of the commands you need to get started. Use the write terminal command to view your configuration at any time. Use the write memory command frequently to save your configuration to Flash memory.
Before you configure the PIX Firewall, sketch out a network diagram with IP addresses that you will assign to the PIX Firewall and those of routers on each interface. If you have more than two interfaces in the PIX Firewall, note the security level for each interface. Security levels are set with the nameif command described in "Step 5 - Identify Each Interface."
Locate the following IP addresses:
•
•
•
Go to the PIX Firewall Configuration Mode
To initially configure the PIX Firewall:
Step 1
Step 2
Step 3
pixfirewall>Enter enable and press the Enter key.
Step 4
Password:Press the Enter key.
Step 5
pixfirewall#>Enter the configure terminal command and press Enter. You are now in configuration mode.
Step 5 - Identify Each Interface
PIX Firewall requires that you enter the nameif and ip address commands to identify each interface in your PIX Firewall that will connect to a network segment. You will need unique IP addresses for the ip address command to assign to each interface you will use.
If the PIX Firewall has Ethernet cards, upon startup, PIX Firewall adds an interface command to the configuration for each interface. The interface command specifies the line speed and duplex for an interface.
PIX Firewall assumes that the outside network is connected to slot 0 on the unit, which is the leftmost slot that can accept cards. For Ethernet, this is known as ethernet0, for Token Ring, it is called token0.
The nameif command
The PIX Firewall default configuration supplies nameif commands for the inside and outside interfaces. Use the show nameif command to view these commands. They will appear as:
nameif ethernet0 outside security0nameif ethernet1 inside security100The nameif commands you need to enter, if any, are determined by how many network interface cards are in your PIX Firewall. The sections that follow describe how to configure this command.
An example nameif command is:
nameif ethernet2 perimeter security50If you make a mistake or want to replace a command you entered, enter the new version of the command, instead of first removing the old version, as is required for other PIX Firewall commands. For example, if you accidentally enter:
nameif ethernot2 permetter security50Reenter the command as:
nameif ethernet2 perimeter security50Two Interface PIX Firewall
If you have only two interfaces, you do not need to enter any further information for the nameif command and can now proceed to next command for your configuration.
Three Interface PIX Firewall
If the PIX Firewall has three interfaces, enter the nameif command for the perimeter interface, which you can name:
nameif ethernet2 interface security_levelIf you have Token Ring, replace ethernetn in the nameif command with token0, token1, token2, and so on for Token Ring. If you have a mixed Token Ring and Ethernet environment, start with ethernet0 or token0 and number the Ethernet or Token Ring interfaces sequentially thereafter.
Replace interface with a name such as dmz or perim for each perimeter interface. Whichever name you pick, you will need to enter it repeatedly as you create your configuration, so a short name, such as dmz, will be easier to enter.
Replace security_level with a value such as security40 or security60. You can choose any security level between 1 and 99 for a perimeter interface as long as they are not the same value. If you have four interfaces, it will be easier to code your configuration if you use the higher security level for the perimeter interface with the most hosts. When you access a higher security level interface from a lower security level interface, you use the static command. When you access a lower security interface from a higher security level interface, you use the nat command. By using the higher security level, hosts on that interface can access the other perimeter interface and the outside interface using the nat command.
You may also want to consider which interface should be your inside interface. While you cannot assign a perimeter interface to have a security level of 100, you can change the cabling of your networks as they connect to the PIX Firewall. Again, the network with the most number of hosts should plug into the network interface card in the second slot (ethernet1 for Ethernet, token1 for Token Ring), which is used for the inside network.
If you have three interfaces, and the interface that was supposed to be the perimeter has more hosts than the inside, it will be easier to configure the PIX Firewall if you switch connections on the PIX Firewall network interface cards so that the inside has the most hosts.
Four Interface PIX Firewall
If the PIX Firewall has four interfaces, enter two nameif commands, one for each perimeter interface. Pick a unique interface name and security level for each:
nameif hardware_id interface security_levelnameif hardware_id interface security_levelReplace hardware_id with the hardware name for the network interface card. For Ethernet cards, use ethernet0, ethernet1, ethernet2, or ethernet3 depending on which interface you want to reference. The number after the name corresponds to the position of the cards in the slots on the PIX Firewall. If you are looking at the slots, the ethernet1 card must be in the second slot from the left that can contain a network interface card. The ethernet1 card must be connected to the inside interface.
You can abbreviate this name with any significant letters, such as, e0 for ethernet0, or t0 for token0.
Replace interface and security_level as described in the section "Three Interface PIX Firewall."
The ip address Command
Assign an ip address command to each interface in your PIX Firewall that connects to the network. In version 4.2(3), for unused interfaces, PIX Firewall assigns 127.0.0.1 to each interface with a subnet mask of 255.255.255.255 that does not permit traffic to flow through the interface. For version 4.2(2), you must assign an IP address to each interface, whether or not they connect to the network.
The format for the ip address command is:
ip address inside ip_address netmaskip address outside ip_address netmaskReplace ip_address with the IP address you specify for the interface. The IP addresses that you assign must be unique for each interface—do not use an address you previously used for routers, hosts, or with any other PIX Firewall command, such as an IP address in the global pool or for a static.
Replace netmask with the network mask for the IP address; for example, 255.255.255.0 for a Class A address. Enter a mask appropriate for the network class, which is determined by the first octet of the IP address. Use a netmask of 255.0.0.0 for IP addresses 1.x.x.x to 127.x.x.x, use 255.255.0.0 for IP addresses 128.x.x.x to 191.x.x.x, and 255.255.255.0 for addresses 192.x.x.x and higher. Do not use 255.255.255.255 for an interface connected to the network because this will stop traffic on that interface.
If subnetting is in use, use the subnet in the mask; for example, 255.255.255.228.
Use the show ip command to view the commands you entered. If you make a mistake while entering a command, reenter the same command with new information.
An example ip address command is:
ip address inside 192.168.1.1 255.255.255.0If you are using subnetting, enter a network mask applicable to the subnet. Refer to Appendix E, "" to ensure that the IP address you pick for each interface is correct for the subnet.
The interface Command
If you have Ethernet interfaces on the PIX Firewall, the default configuration provides interface commands for all interfaces. If you have Token Ring interfaces, you will need to create interface commands in this format:
interface token speedReplace token with token0, token1, and so on. Replace speed with either 4mbps or 16mbps depending on the line speed of the card.
Use the write terminal command to view the configuration and locate the interface command information. If you make a mistake while entering a command, reenter the same command with new information.
Examples of the interface command are:
interface ethernet0 autointerface token0 16mbpsStep 6 - Let Users Start Connections
As described in the section, "Step 5 - Identify Each Interface," the nameif command assigns a security level to each interface. For interfaces with a higher security level such as the inside interface, or a perimeter interface relative to the outside interface, use the nat and global commands to let users on the higher security interface access a lower security interface. For the opposite direction, from lower to higher, you use the static and conduit commands described in the section "Step 13 - Add Server Access."
As you enter commands, you can use the show nat or show global commands to list the existing commands. If you make a mistake, remove the old command with the no form of the command, specifying all the options of the first command. This is where a terminal with cut and paste capability is useful. After you use show global, you can cut the old command, enter no and a space on the command line, paste the old line in, and press the Enter key to remove it.
PIX Firewall favors the use of NAT (Network Address Translation) for addressing of your network. When a PIX Firewall is first inserted in a network, keeping existing addressing may appear desirable, but imposes an extra layer of complexity in working with the PIX Firewall. Almost all of the PIX Firewall commands that work with IP addresses are affected by the use of NAT.
As you enter each command and debug it, you have to work with how your network addressing affects server access, creating global pools, authentication, routing, and starting connections. When you add in multiple interfaces, the complexity rises more. For this reason, Cisco recommends that you use PIX Firewall with NAT if possible. If you must disable NAT, use the nat 0 command. Refer to the nat and static command pages for a discussion of the implications of disabling NAT.
To let users on a higher security level interface start connections:
Step 1
Step 2
outside: 204.31.17.1,
security 0dmz1: 192.168.1.1,
security 40PIX Firewall
dmz2: 192.168.2.1,
security 60
inside: 192.168.3.1,
security 100
Step 3
nat (inside) 1 0 0nat (dmz2) 1 0 0nat (dmz1) 1 0 0Each nat command statement lets users start connections from the higher security level interface, shown in parentheses, to any lower security level interface. Therefore, the nat (inside) 1 0 0 command statement lets inside users start connections on the dmz1, dmz2, and outside interfaces. Similarly, the dmz2 nat command statement lets dmz2 users start connections on the dmz1 interface and the outside interface. Lastly, the dmz1 nat command statement lets dmz1 users start connections on the outside.
Step 4
global (outside) 1 204.31.17.2 netmask 255.255.255.0global (dmz1) 1 192.168.1.10-192.168.1.100 netmask 255.255.255.0global (dmz2) 1 192.168.2.10-192.168.2.100 netmask 255.255.255.0These statements create a pool of global addresses on the outside interface so that users on the inside, dmz1, and dmz2 can access the outside interface. Because this is a registered address, a PAT (Port Address Translation) global is used because it lets up to 65,000 users pass through to the outside. PIX Firewall only permits one PAT global in the configuration, so using it on the interface with the most traffic across a registered address is the best use of it. However, using a PAT global has a few caveats such as limits on multimedia applications such as H.323. Refer to the global command page for more information.
The next global statement for dmz1 lets users on the inside and dmz2 start connections on the dmz1 interface.
The last global statement for dmz2 lets users on the inside start connections on the dmz2 interface.
If you use network subnetting, specify the subnet mask with the netmask option. Refer to Appendix E, "" for more information on subnetting.
Step 5
global (outside) 1 204.31.17.10 netmask 255.255.255.0global (outside) 1 204.31.17.11-204.31.17.100 netmask 255.255.255.0In this example, if the addresses in the second global statement are used up, then the PAT address is used. This helps offset the PAT global's restrictions, such as with multimedia applications, so that users will only hit the PAT when the first range is unavailable—if a user cannot start a connection because of an application conflict, another should appear momentarily to let the user try again. Global addresses are freed up as soon as the session ends.
Step 7 - Create a Default Route
Use the route command to set a default route to the outside router. Use the show route command to view the command you entered. If needed, use the no route command to remove a route command. If the outside router is at address 204.31.17.3, you would use this command:
route outside 0 0 204.31.17.2 1This command states that the default router is on the outside interface. The 0 0 information is an IP address of 0.0.0.0 and mask of 0.0.0.0, which the PIX Firewall associates with the default route. The route command could be read as "if I have a packet intended for IP address 0.0.0.0, send it to 204.31.17.2 instead." The 1 at the end is the number of hops that the router is from the PIX Firewall. Hops are routers, so 1 hop is the router nearest the PIX Firewall.
If the PIX Firewall has only two interfaces, you can specify a default route for the inside. Note that this exception only applies when the PIX Firewall has physically two interfaces. If a third interface is present in the firewall without a cable connection, you have to physically remove the card before you can use this exception. If there are only two interfaces, the default route command for the inside will eliminate having to add static route statements for the networks connected to the inside router (if any).
Note
Step 8 - Permit Ping Access
Enter the conduit permit icmp any any command in your configuration. This lets hosts on the inside ping outside hosts and hosts on the outside ping global addresses configured with the conduit command.
Step 9 - Store the Image in Flash Memory and Reboot
When you complete entering commands in the configuration, save it to Flash memory with the write memory command.
Then use the reload command to restart the configuration. After you enter the reload command, PIX Firewall prompts you to confirm that you want to continue. Enter y and the reboot occurs.
You are now done configuring the PIX Firewall. This configuration lets protected network users start connections, but prevents users on unprotected networks from attacking protected hosts.
Step 10 - Check the Configuration
Use the write terminal command to view your current configuration. Check the following before proceeding to ensure that your configuration is correct:
Step 1
show ip addressshow globalshow natshow routeStep 2
route outside 0 0 ip_address_of_outside_router 1Replace ip_address_of_outside_router with the IP address of the nearest router on the outside interface.
If you do not see this command in your configuration, add it now. A default route command is crucial to get other commands to work correctly. If you are testing the network before putting it into production, get a router and add it to the test network so that the PIX Firewall has a default route.
Step 3
nat (dmz) 1 0 0global (outside) 1 204.31.17.2 netmask 255.255.255.0The number 1 after the interface name is the NAT ID.
Also, it is best to keep all the nat statements and globals in the same NAT ID even if the global statements refer to different interfaces, for example:
nat (inside) 1 0 0nat (dmz1) 1 0 0nat (dmz2) 1 0 0global (outside) 1 204.31.17.2 netmask 255.255.255.0global (outside) 1 204.31.17.10-204.31.17.200 netmask 255.255.255.0global (dmz1) 1 192.168.1.20-192.168.1.200 netmask 255.255.255.0The nat statements let users on the inside, dmz1, and dmz2 interfaces start outside connections. The first global statement creates a PAT address on the outside interface at the end of the range of globals. (PIX Firewall reads through the global IP addresses starting from the highest and going to the smallest.)
The second global statement creates a pool of IP addresses in the range of 204.31.17.30 to 204.31.17.200 on the outside interface.
The third global statement creates a pool of IP addresses on the dmz1 interface.
Step 4
Step 5
Step 6
(a)
(b)
ip address outside 204.31.17.1 255.255.255.192The global command would appear as:
global (outside) 1 204.31.17.75-204.31.17.126 netmask 255.255.255.192Step 7
nat (dmz1) 1 10.0.0.0 255.0.0.0If you want only users on the 10.0.0.0 network to start connections, do not specify a second nat group with address 10.1.1.0 because this network would be included in 10.0.0.0.
Step 8
Make sure all inside interface or perimeter interface hosts and routers have their default routes set to the respective PIX Firewall interface IP address. Refer to section "Step 3 - Configure Network Routing" for more information.
Step 11 - Test Network Connectivity
For the steps that follow, you will need access to the PIX Firewall console and to at least one host on both the internal and external networks.
Use the steps that follow to determine whether or not the firewall is functioning correctly in the network:
Step 1
router: 204.31.17.2
outside: 204.31.17.1router: 192.168.1.2
dmz1: 192.168.1.1PIX Firewall
router: 192.168.2.2
dmz2: 192.168.2.1inside: 192.168.3.1
router: 192.168.3.2
For example:
Step 1
If you are using version 4.2(3), before using the debug command, use the who command to see if there are any Telnet sessions to the console. If the debug command finds a Telnet session, it automatically sends the debug output to the Telnet session instead of the console. This will cause the serial console session to seem as though no output is appearing when it is really going to the Telnet session.
Step 2
ping inside 192.168.3.2ping dmz1 192.168.1.2ping dmz2 192.168.2.2ping outside 204.31.17.2Then ping the PIX Firewall interfaces from the hosts or routers with commands such as:
ping 192.168.3.1ping 192.168.1.1ping 192.168.2.1ping 204.31.17.1
If the pings from the hosts or routers to the PIX Firewall interfaces are not successful, check the debug messages which should have displayed on the console. Successful ping debug messages appear as in this example:
ICMP echo request (len 32 id 1 seq 512) 204.31.17.42 > 204.31.17.1ICMP echo reply (len 32 id 1 seq 256) 204.31.17.1 > 204.31.17.42Both the request and reply statements should appear to show that the PIX Firewall and responded. If none of these messages appeared while pinging the interfaces, then there is a routing problem between the host or router and the PIX Firewall that caused the ping (ICMP) packets to never arrive at the PIX Firewall.
Also try the following to fix unsuccessful pings:
(a)
route outside 0 0 204.31.17.2 1(b)
(c)
(d)
(e)
(f)
Ping through the PIX Firewall—Once you can ping the PIX Firewall's inside interface, try pinging through the PIX Firewall to a host on another interface, such as the outside. If there is not a host on the interface, ping the router. If the ping is not successful, check the debug messages on the PIX Firewall console to be sure both inbound and outbound pings were received. If you see the Inbound message without the Outbound, then the host or router is not responding. Check that the nat and global statements are correct and that the host or router is on the same subnet as the outside interface. Successful ping debug messages appear as in this example:
Inbound ICMP echo reply (len 32 id 1 seq 256) 204.31.17.1 > 204.31.17.42Outbound ICMP echo request (len 32 id 1 seq 512) 204.31.17.42 > 204.31.17.1Step 3
Step 12 - Add Telnet Console Access
The serial console lets a single user configure the PIX Firewall, but many times this is not convenient for a site with more than one administrator. PIX Firewall lets you access the serial console via Telnet from hosts on the inside interface.
To configure Telnet console access:
Step 1
telnet 192.168.1.2 255.255.255.255Step 2
telnet timeout 15Step 3
To test Telnet access:
Step 1
telnet 192.168.1.1Step 2
PIX passwd:Enter cisco and press the Enter key. You are then logged into the PIX Firewall.
The default password is cisco, which you can change with the passwd command.
You can enter any command on the Telnet console that you can set from the serial console, but if you reboot the PIX Firewall, you will need to log back into the PIX Firewall after it restarts.
Some Telnet applications such as the Windows 95 or Windows NT Telnet sessions may not support access to the PIX Firewall's command history feature used with the arrow keys. However, you can access the last entered commands by pressing Ctrl-P.
Step 3
In versions prior to 4.2(3), you can only view the ICMP traces from the serial console and not from a Telnet session. If you are using version 4.2(3), messages for a successful ping appear as:
Inbound ICMP echo reply (len 32 id 1 seq 256) 204.31.17.1 > 204.31.17.42Outbound ICMP echo request (len 32 id 1 seq 512) 204.31.17.42 > 204.31.17.1Step 4
(a)
If you are using the PIX Firewall in production mode, you may wish to use the logging buffered 7 command to store messages in a buffer that you can view with the show logging command, and clear the buffer for easier viewing with the clear logging command. To stop buffering messages, use the no logging buffered command.
You can also lower the number from 7 to a lesser value, such as 3, to limit the number of messages that appear.
(b)
Trace Channel Feature
In version 4.2(3), the debug command has changed so that the debug icmp trace and debug sqlnet commands now send their output to the Trace Channel. The location of the Trace Channel depends on whether you have a simultaneous Telnet console session running at the same time as the console session, or if you are using only the PIX Firewall serial console:
•
•
•
•
The debug commands are shared between all Telnet and serial console sessions.
Note
Step 13 - Add Server Access
By default, the PIX Firewall prevents all outside connections from accessing "inside" hosts or servers. Any server on a network that has a higher security level than the current interface requires a static and conduit statement.
Note
For example to let outside users access a dmz1 web server, you could have static and conduit statements as follows:
static (dmz1,outside) 204.31.17.5 192.168.1.5 netmask 255.255.255.255conduit permit tcp host 204.31.17.5 eq www anyIn this example, the static command maps access to the dmz1 host 192.168.1.5 through a global address on the outside interface of 204.31.17.5. The conduit command lets any users on the outside access IP address 204.31.17.5 using a web browser on port 80 (www). In this example, the higher security level interface is dmz1 and the lower is the outside interface. On the outside interface, through the use of DNS, a company can map 204.31.17.5 to their web site address of www.caguana.com.
To help you code server access, use this rule for creating static statements:
static (high,low) low high
The idea is to present an IP address to users on one interface that gives them access to a host on another. You use the static command to let users on a lower security level interface access a server on a higher security level interface. You use the nat command to let users on a higher security level interface access a lower security level interface.
To create server access:
Step 1
Step 2
For example:
outside: 204.31.17.1,
security 0dmz1: 192.168.1.1,
security 40PIX Firewall
dmz2: 192.168.2.1, security 60
web server 192.168.2.3
inside: 192.168.3.1,
security 100
mail server 192.168.3.4
From this scenario, you will need static statements to let outside users access the dmz2 web server and for dmz1 users to access dmz2. You will need a nat statement to let inside users access the dmz2 web server. For the mail server, you will need static statements for access from the outside, dmz1, and dmz2.
Step 3
static (inside,outside) 204.31.17.4 192.168.3.4 netmask 255.255.255.255conduit permit tcp host 204.31.17.4 eq smtp anyThese commands create a global address of 204.31.17.4 that PIX Firewall maps to the 192.168.3.4 mail server on the dmz2 interface. The conduit statement permits any outside users to access the mail server at the SMTP port (25).
You will need to inform your DNS administrator to create an MX record for the global address (such as 204.31.17.4) so that mail is directed to the correct address.
The "any" in the conduit statement means that any host on the outside interface can access the conduit because the static associates an inside server to an outside address. PIX Firewall makes this distinction to protect access to the conduits. This is very important when there are multiple interfaces. If you set up a conduit for the dmz2 interface to access the dmz1 interface, you would not want outside users to be able to access the conduit. PIX Firewall handles this for you. It automatically determines which interfaces are mapped together with the static statement.
Two conduit statements are required for establishing access to the following services: discard, dns, echo, ident, pptp, rpc, sunrpc, syslog, tacacs-ds, talk, and time. Each service, except for pptp, requires one conduit for TCP and one for UDP. For DNS, if you are only receiving zone updates, you only need a single conduit statement for TCP.
The two conduit statements for the PPTP transport protocol, which is a subset of the GRE protocol, are as shown in this example:
static (dmz2,outside) 204.31.17.5 192.168.1.5 netmask 255.255.255.255conduit permit tcp host 204.31.17.5 eq 1723 anyconduit permit gre host 204.31.17.5 anyIn this example, PPTP is being used to handle access to host 192.168.1.5 on the dmz2 interface from users on the outside. Outside users access the dmz2 host using global address 204.31.17.5. The first conduit statement opens access for the PPTP protocol and gives access to any outside users. The second conduit permits access to GRE. If PPTP was not involved and GRE was, you could omit the first conduit statement.
Step 4
static (inside,dmz1) 192.168.1.4 192.168.3.4 netmask 255.255.255.255conduit permit tcp host 192.168.1.4 eq smtp anystatic (inside,dmz2) 192.168.2.4 192.168.3.4 netmask 255.255.255.255conduit permit tcp host 192.168.2.4 eq smtp anyThese statements create a global address on each interface to map to the inside mail server and then create a conduit so that users on each interface can access the mail server via the SMTP port (25).
Step 5
To let users access the web server:
Step 1
static (dmz2,outside) 204.31.17.3 192.168.2.3 netmask 255.255.255.255conduit permit tcp host 204.31.17.3 eq www anystatic (dmz2,dmz1) 192.168.1.3 192.168.2.3 netmask 255.255.255.255conduit permit tcp host 192.168.1.3 eq www anynat (inside) 1 0 0global (dmz2) 1 192.168.2.10-192.168.2.100 netmask 255.255.255.0The static and conduit statements work the same way as described before for the mail server, creating a global address through which users on the interface can access the web server. The global command adds a new dimension to server access. Because the inside interface is at a higher security level than the dmz2 interface, instead of using the static and conduit commands to permit access, you use the nat and global commands. (The nat statement is probably a redundancy because your configuration should already have this command as described in the section "Step 6 - Let Users Start Connections"—do not enter this command twice in the configuration.)
The nat statement lets inside users start connections on any interface of a lower security level; therefore, they can access the dmz2 interface. The global command lets the inside users translate their connections to access the address of the web server on the dmz2 interface.
Step 2
Step 14 - Add Static Routes
Specify a static route for each network connected to any router. Refer to the section "Step 7 - Create a Default Route" for information on default routes, and to the section "Step 3 - Configure Network Routing" for information on configuring routers and hosts for default routes.
To add static routes:
Step 1
Step 2
route outside 0 0 204.31.17.2 1This statement sends all packets destined for the default route, IP address 0.0.0.0 (abbreviated as 0, and 0 for the netmask), to the router 204.31.17.2. The "1" at the end indicates that the router is the router closest to the PIX Firewall; that is, one hop away.
In addition, you must add static routes for the networks that connect to the inside router as follows:
route inside 192.168.4.0 255.255.255.0 192.168.3.5 1route inside 192.168.5.0 255.255.255.0 192.168.3.5 1These static route statements can be read as "for packets intended for either network 192.168.4.0 or 192.168.5.0, ship them to the router at 192.168.3.5." The router decides which packet goes to which network. The PIX Firewall is not a router and cannot make these decisions.
The "1" at the end of the statement specifies how many hops (routers) the router is from the PIX Firewall. Because it is the first router, you use 1.
Step 3
route inside 192.168.6.0 255.255.255.0 192.168.2.5 1route inside 192.168.7.0 255.255.255.0 192.168.2.5 1These statements direct packets intended to the 192.168.6.0 and 192.168.7.0 networks back through the router at 192.168.3.5.
Step 15 - Enable Syslog
The syslog message facility in the PIX Firewall is a useful means to view troubleshooting messages and to watch for network events such as attacks and service denials. You can view syslog messages either from the PIX Firewall console or from a syslog server that the PIX Firewall sends syslog messages to.
To view messages from the PIX Firewall console:
Step 1
Step 2
logging buffered debuggingThis command opens syslog up for all possible messages. The debugging setting is very useful for troubleshooting, but on a PIX Firewall in production, will generate too many messages to make troubleshooting viable. If you are testing a production mode PIX Firewall, substitute the errors keyword for the debugging keyword. This will reduce the messages to only those generated by logging levels 0, 1, 2, and 3. Refer to the System Log Messages for the PIX Firewall guide for information about which messages display at each syslog level. You can view this guide online at:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v42/syslog/index.htm
Step 3
conduit permit icmp any anyIf this command is not present, then add it.
Step 4
Step 5
Step 6
logging buffered alertsThis command will only store messages of levels 0 and 1.
To view syslog messages on a Telnet console session:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
terminal no monitorno logging monitorThe information in the remainder of this section describes additional information on the logging command and how to configure PIX Firewall to send messages to a syslog server.
More on the logging Command
The logging facility and logging level commands configure the facility and level of syslog messages. Because network devices share the eight facilities, logging facility lets you set the facility marked on all messages. Messages are sent to the syslog host over UDP. The logging on command starts sending messages onto the network. Use the logging host command to specify which systems receive the messages.
You can use show logging to view previously sent messages.
The PIX Firewall generates syslog messages for system events, such as security alerts and resource depletion. Syslog messages may be used to create email alerts and log files, or displayed on the console of a designated host using UNIX syslog conventions.
A PC WinSock version of syslogd will also work.
The PIX Firewall sends syslog messages to document the following events:
•
•
•
•
Logging is enabled by configuring the PIX Firewall with the IP address of the log host.
Syslog Facility and Level
The logging facility and logging trap commands let you specify the syslog facility and level for how messages are sent to the syslog host.
The facility consists of eight facilities LOCAL0(16) through LOCAL7(23); the default is LOCAL4(20). Hosts file the messages based on the facility number in the message.
The level specifies the types of messages sent to the syslog host. Setting the level to 3, the default value, for example, allows messages with levels 0, 1, 2, and 3 to display. The default is 3. The level values are:
Table 2-2 Syslog Message Levels
0
emergencies
System unusable messages
1
alerts
Take immediate action
2
critical
Critical condition
3
errors
Error message
4
warnings
Warning message
5
notification
Normal but significant condition
6
informational
Information message
7
debugging
Debug messages and log FTP commands and WWW URLs. For more information about logging FTP commands and URLs, refer to "FTP and URL Logging" in Chapter 3, "."
Configuring PIX Firewall to Send Syslog Messages
To configure the PIX Firewall to send syslog messages to the UNIX host:
Step 1
Step 2
logging host interface ip_addressReplace interface with the name of the interface on which the syslog server resides. Replace ip_address with the IP address of the syslog server.
For example, if the syslog server is on the dmz interface at 192.168.1.2, the command would be:
logging host dmz 192.168.1.2Step 3
logging facility 20Facility 20 sends messages to the UNIX local4 message receiving mechanism, which is described in the section Configuring a UNIX System for Syslog.
Step 4
logging trap warningsThis same command starts sending syslog events to an SNMP server as well.
Step 5
Configuring a UNIX System for Syslog
After you have configured PIX Firewall to send syslog messages, configure either a PC or UNIX host to receive the messages. This section describes how to configure a UNIX host to receive syslog messages.
To configure a UNIX system to accept syslog messages:
Step 1
Step 2
# mkdir /var/log/pix# touch /var/log/pix/pixfirewallStep 3
# PIX Firewall syslog messageslocal4.error /var/log/pix/pixfirewallThis configuration directs the PIX Firewall syslog message to the specified file. Alternatively, if you want the message sent to the logging host console or emailed to a system administrator, refer to the UNIX syslog.conf(4) manual page.
Note
Entries in /etc/syslog.conf must follow these rules:
(a)
(b)
(c)
Step 4
# kill -1 `cat /etc/syslog.pid`This command lists the syslog process ID. This number may vary by system. The second command sends syslog the HUP signal to cause it to restart.
Step 16 - Create Access Lists
PIX Firewall provides the outbound and apply commands that you can use to limit internal users access to services on external interfaces. Use these commands to limit access for users who are on higher security level interface from accessing a lower security level interface; for example, from the inside to the outside, from the inside to a perimeter interface, or between perimeter interfaces. These commands follow the direction of the nat command—also from a higher security level interface to a lower security level interface.
The outbound and apply commands' use is very interwoven. Depending on how you set the apply command, you use the outbound command to specify the details. The apply command lets you specify the interface you want to protect and how you are using the access list—to limit service access to your internal users (with the outgoing_src option, or to limit internal users access to a specific site (with the outgoing_dest option).
The outbound command specifies whether you are permitting or denying access, the affected IP addresses, and the port number or numbers. To coordinate the outbound and apply statements, there is an identification number on both commands called the "list ID." The list ID is also used to order groups of commands so as to determine which group is processed first. This number is independent of the nat and global identification numbers—you can use the same number or another. Cisco recommends coding list IDs with a gaps to permit future additions, such as 10, 20, 30, or 100, 200, 300. Just be sure to use the same list ID on the apply statement as on the outbound command for the same group. For example:
outbound 10 deny 0 0 www tcpoutbound 10 permit 192.168.1.2 255.255.255.255 www tcpapply (dmz1) 10 outgoing_srcIn addition, the order in which you specify the outbound commands determines how PIX Firewall evaluates them. The outbound command statements are ordered first by denies, then permits, and then by the list ID. Then there is the except option to this command which has its own set of rules which are best viewed on the outbound / apply command page in Chapter 5, "."
There are a few caveats with the outbound command. With the outgoing_src option to apply, you can only specify the internal hosts that are affected, not where you want them to go. Use outgoing_src to regulate access to services (ports) and protocols.
With the outgoing_dest option, you can only specify which host you do not want users to access, but not limit specific users access to the host. Use outgoing_dest to regulate access to a host.
Before creating an access list:
Step 1
Step 2
To limit users access to a service:
Step 1
outbound 10 deny 192.168.1.0 255.255.255.0 irc tcpStep 2
outbound 10 permit 192.168.1.42 255.255.255.255 irc tcpStep 3
apply (dmz1) 10 outgoing_srcTo limit users access to a host:
Step 1
outbound 20 deny 204.31.17.42 255.255.255.255 www tcpStep 2
apply (dmz1) 20 outgoing_destStep 17 - Add User Authentication
User authentication and authorization starts with your security policy and the respective inside RADIUS or TACACS+ server that you have.
Authentication verifies that a user is who they say they are. Authorization determines what services a user can use to access a host.
From the configuration on this server you need to determine which users can access the network, which services they can use, and what hosts they can access. Once you have this information, you can configure the PIX Firewall to either enable or disable authentication or authorization.
In addition, you can also configure the firewall to permit users access to specific hosts or services. However, if you configure the firewall to this degree, you risk the information being different between the authentication server and the firewall. After you enable authentication and authorization, the PIX Firewall provides credential prompts to inbound or outbound users for FTP, Telnet, or HTTP (Web) access. The actual decision about who can access the system and with what services is handled by the authentication and authorization servers.
To provide user authentication and authorization:
Step 1
Step 2
Step 3
Step 4
aaa authentication any outbound 0 0 0 0 tacacs+aaa authentication any inbound 0 0 0 0 tacacs+In these commands, if the server is RADIUS, use radius instead of tacacs+. While the aaa authentication command lets you specify hosts that can be authenticated or specific hosts, if you implement this level of management in the firewall, you run the risk that your authentication server and the firewall can have different configurations. For example, if the authentication server is only accepting Telnet logins and you set the firewall for FTP, no users will be authenticated.
Step 5
aaa authorization any outbound 0 0 0 0aaa authorization any inbound 0 0 0 0Step 18 - Recheck the Configuration
When you have completed your configuration, check it carefully as described in the following steps and tips:
Step 1
Step 2
Step 3
(a)
(b)
(c)
(d)
Step 4
(a)
(b)
(c)
static (dmz2,dmz1) 10.1.1.2 192.168.1.2 netmask 255.255.255.255conduit permit tcp host 10.1.1.2 eq smtp 10.1.1.0 255.255.255.0In this example, the static statement maps the 192.168.1.2 mail server on the dmz2 interface so that users on the dmz1 interface can access the server as 10.1.1.2. The conduit statement specifies that only users on the 10.1.1.0 network can access the server via the SMTP port (25).
(d)
(e)
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Additional tips to consider are as follows:
•
•
%PIX-3-305005: No translation group found for packet%PIX-3-305006: xlate_type translation creation failed for packetWhen the messages display, the contents of the packet displays as text. The xlate_type can be either static, portmapped, or regular. Portmapped refers to a PAT global.
•
•
•
•
•
•
