Cisco PIX 501 firewall configuration

Question

I have bought PIX 501 router for my home network (2 laptops and broadband cable modem).

I am trying to configure it. I am able to connect to PIX via console and Hyperterminal. I used initial setup procedure.

But I cannot connect to PIX from the laptop via Ethernet. "Inside" interface IP address is 10.1.1.1, 255.255.255.0

I attach port 1 of PIX firewall to the laptop by the ethernet cable which is not a crossover. I try to ping 10.1.1.1. from the laptop but it fails. It fails if IP address is obtained automatically. It also fails if I assign static IP address to the laptop (10.2.2.100 255.255.255.255).

I'd like to connect to PIX using web interface (https://192.168.1.20) but it fails.

Is anything missing in the configuration?

Current configuration is below.

PIX Version 6.3(3)                  
interface ethernet0 auto shutdown                                 
interface ethernet1 100full                           
nameif ethernet0 outside security0                                  
nameif ethernet1 inside security100                                   
enable password laYDkT.MQTk8cQfX encrypted                                          
passwd 2KFQnbNIdI.2KYOU encrypted                                 
hostname pixfirewall                    
domain-name MSHOME1                   
fixup protocol dns maximum-length 512                                     
fixup protocol ftp 21                     
fixup protocol h323 h225 1720                             
fixup protocol h323 ras 1718-1719                                 
fixup protocol http 80                      
fixup protocol rsh 514                      
fixup protocol rtsp 554                       
fixup protocol sip 506                    
fixup protocol sip udp 5060                           
fixup protocol skinny 2000                          
fixup protocol smtp 25                      
fixup protocol sqlnet 1521                          
fixup protocol tftp 69                      
names     
pager lines 24              
mtu outside 1500                
mtu inside 1500               
no ip address outside                     
ip address inside 10.1.1.1 255.255.255.0                                        
ip audit info action alarm                          
ip audit attack action alarm                            
pdm history enable                  
arp timeout 14400                 
timeout xlate 3:00:00                     
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00                                                


timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00                 

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 82.18.242.134 255.255.255.255 inside

http 10.2.2.1 255.255.255.255 inside

http 169.254.133.244 255.255.255.255 inside

http 192.168.1.20 255.255.255.255 inside

http 192.168.1.1 255.255.255.255 inside

http 10.2.2.100 255.255.255.255 inside

no snmp-server location

no snmp-server contact
snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

Cryptochecksum:2dee8e551c8a266adfb582c5b2900920

: end

[OK]

What? You bought a *what* for your home network? OMG. I know they are old beasts, but you, sir, my namesake, you have to most serious case of overkill-itis I have ever witnessed. I tip my hat to you. Seriously though, if this fails to work, what are you going to do? Replace it with a Check Point Power-1 11075 ;-) — wzzrd, Jan 11 '11 at 12:31

score 1 · Answer 1 · answered Sep 08 '10 at 10:19

1

This is a home network, so not ServerFault related.

Anyways, try https://10.1.1.1 from your laptop.

answered Sep 08 '10 at 10:19

pauska

19,620
5
57
75

1

I think the fact that it's 'enterprise' hardware normally dealt with by a sys/network admin probably makes it a serverfault question. – Cian Sep 09 '10 at 11:19

score 0 · Answer 2 · answered Sep 15 '10 at 18:30

Check the subnet mask you're giving to the inside interface. In the config above, you list

10.1.1.1 255.255.255.255

Which gives an address range of 10.1.1.1 to 10.1.1.254. If you're giving your laptop an address of 10.2.2.100, that's outside the range.

Try either giving your laptop 10.1.1.2 (or something else on the 10.1.1 network) or changing the netmask on the router interface to 255.0.0.0

score 0 · Answer 3 · answered Dec 06 '14 at 02:59

Use the serial cable and reset it. Will pop up a config menu after for the initial setup in the console.

Do that after; telnet 10.0.0.0 255.0.0.0 inside

For the web page configuration forget that, you miss the pdm config, and most of all you must use Java 1.6.0_1 (the max version you can go)

Second point, you have no NAT rule at all..

Would be a rule like that, and I surelly miss some access-list command

static (inside,outside) WAN_IP 10.1.1.0 netmask 255.255.255.0

nat (inside) 1 10.1.1.0 255.255.255.0

Cisco PIX 501 firewall configuration

3 Answers3