Tag Archives: pix serial number

Build a PIX Firewall for your test network

Posted on by

Working with GNS3 and PEMU – (Part 2)

KB ID 0000662 

Problem

In Part 1 we installed and Licensed our Virtual PIX, now we will give it an IP address and get the firewalls web management console running.

To complete this procedure you will need to,

1. Have a TFTP server up and running (CLICK HERE).

2. Know how to connect to a Cisco Firewall (CLICK HERE).

Solution

Step 1 (Add an interface to your host machine)

1. On your host PC/VM Click Start > Run > hdwwiz.cpl {enter} > At the “Add Hardware Wizard” click Next > Let it search > Tick “Yes I’ve allready connected the hardware > Next > Scroll to the bottom > Select “Add a new hardware Device > Next.

2. Select “Install the hardware that I manually select” > Next > Next > Select Network Adaptor > Next > Next > Finish.

3. Click Start > Run > ncpa.cpl > Right Click the new NIC and rename it to loopback adaptor > Then give it a valid IP on your test network. (Right click > properties > TCP/IP).

Step 2 (Configure the connection)

4. Connect to the PIX as shown in Part 1 > Give the PIX an IP address with the following commands;

[box]

enable
{Password} - Set blank by default
configure terminal
int e1
no shutdown
nameif inside
ip address {ip on test network}{subnet of test network}
write men

[/box]

5. To connect tie PIX to the Loopback adaptor you need to add some networking in the GNS3 console > Drag the cloud object into the work area > Right click > Configure.

6. Select C0.

7.Select the loopback adaptor > Add > Apply OK

Note: If you are presenting a real adaptor you will only see some uncomprehensable numbers – locate the “Network Device List” Batch file in the GNS3 directory and run it whis will de-cypher those numbers for you.

8. Drag a switch onto the workspace.

9. Click the connection tool and select “Fast Ethernet”.

10 Select the cloud (Loopback Adaptor) and drag a connection to the switch.

11. Select the PIX (Inteface e1) and drag a connection to the switch.

12. All green lights is good 🙂

13 From another machine on the network make sure you can ping the PIX to test connectivity.

Note: If you are using Microsoft Hyper-V server, you may find that the whole thing fails at this point, If thats the case, then close down the Guest machine and add and configure a “Legacy Network Card”. Bring the system back up and configure the new network card accordingly.

Also if you are in a virtual environment you can simply add another network card and get the cloud to use that instead of using a loopback adapter.

Step 3 Install and configure the ASDM (Web Inteface)

1. Set up your TFTP server and have the asdm image file ready in the TFTP servers root directory.

2. We are now going to allow connection to the PIX via Telnet – becaue the console can be a bit twichy in the GNS3 environment.

[box]

enable
{Password} <-blank be default
configure terminal
telnet 0.0.0.0 0.0.0.0 inside
passwd cisco <- sets telnet password to cisco
write men

[/box]

3. Now you can telnet to the PIX from another machine and copy the ASDM image from your TFTP server to the PIX.

[box]

enable
{Password} <-blank by default
copy tftp flash
{ip of the hosst running TFTP}
{filename of the asdm inage}
{Enter} to accept

[/box]

4. Once the file is copied over you need to let the Firewall know that its the one to use, turn on the internal http server and allow access.

[box]

enable
{Password} <-blank by default
conf t
asdm image flash:asdm-603.bin
http server enable
http 0.0.0.0 0.0.0.0 inside
write men

[/box]

The file will be copied over into the firewalls flash memory (Time for a coffee).

5. Now simply connect via the ADSM inteface – if your unsure how to do that see my article here

Using the information above you can present multiple network cards and clouds to the Virtual firewalls various interfaces (There are 5 interfaces on this firewall – its a PIX 525) – enjoy

NB Please dont email and ask me for PIX images and/or activation keys as refusal often offends – PL

Related Articles, References, Credits, or External Links

NA

Build a PIX Firewall for your test network

Posted on by
Working with GNS3 and PEMU – (Part 1)

KB ID 0000061 

Problem

Cisco Firewall’s are expensive, I know I own some, and my firm sells them, getting hardware to run on your test bench is difficult enough, but getting high end Cisco equipment is an expensive proposition for your average “Techy”. These days most people run their test networks in virtual environment. I run Hyper-V at at home for Testing and I have my own VMware ESX server at work for testing and proof of concept work.

However the big problem is to build test networks that reflect what we are doing in a corporate environment. We usually have to compromise and find some obscure Linux firewall to pop in the virtual environment, which is a pain if like me your a died in the wool Cisco-ite.

To do this we need some software – PEMU PIX emulator has been out for quite some time, but some users will find it “sandal wearingly difficult” to set up, so an easier prospect is to use the GNS3 software which is a nice GUI wrapper that contains PEMU (It does a lot more as well but that’s outside the scope of this exercise).

What do you need?

1. A PC – I’m running on a windows XP VM but a physical machine will do just as well.

2. A version of the Cisco PIX software, this needs a Valid Cisco support agreement and a CCO Login to Cisco.

3. A Valid Cisco PIX Serial Number and activation key – from a firewall you have legally purchased!.

Solution

Step 1 (Get Everything together)

1. Download GNS3 from http://www.gns3.net/

2. Download the PIX Operating system from Cisco (Note PIX and ASA firewall’s have DIFFERENT operating systems). At time of writing the latest version is 8.0(3) so this is the one we will use. At this point it might be worth downloading the ASDM which we will use in part 2 later – at time of writing 6.0(3)).

Step 2 Install and configure GNS3

3. Run the setup file for GNS3.

4. Click Next > I Agree > Next > Next > Next Install.

5. You may need to install WinPcap as part of the install just accept all the defaults. When done, GNS3 setup will continue.

6. Click finish

7. Launch GNS3

8. If the setup wizard starts just click OK. Click Edit > Preferences.

9. Select Pemu on the left then enter the following three pieces of information Under “Defaults PIX Settings”. PIX Image: The path to the PIX OS you downloaded in step 2. Key: the activation Key from your PIX Firewall. Serial: The Serial number of the PIX Click Apply > OK

Note: This trips a lot of people up (Including me for about three hours!) You get the key and serial from the firewall by issuing a “show version” command. However modern PIX firewall’s display their Serial number in Decimal, PEMU was built when PIX was at version 6 and the serials in those days were displayed in HEX – so use windows calculator (in scientific mode) to convert the serial number to HEX (EXAMPLES BELOW ARE NOT REAL KEYS!!)

Like so,

PIX Serial = 405400123 converted to Hex = 1829EA3B Key to Enter = 0x1829EA3B

If the activation key is 0x36b86cee 0xb136bdee 0x20c173ee 0xf62b35ee you remove the spaces and replace them with commas, i.e. 0x36b86cee,0xb136bdee,0x20c173ee,0xf62b35ee

10. Back in the main screen click and drag the PIX firewall from the left hand column to the central workspace.

11. Right click the firewall and Select Start

12. Right click it again and select console >and you will connect to the virtual firewall.

13. Now you have to enter the Activation key (Yes even though you have allready put it in).

Enter the following commands;

Note: NOT REAL KEYS!!

[box]enable {password} – blank by default configure terminal activation 0x36b86cee 0xb136bdee 0x20c173ee 0xf62b35ee write mem reload[/box]

That’s you up and running,Note: the passwords will be blank. In Part 2 we will install the web management console and give the PIX a real connection.

 

Related Articles, References, Credits, or External Links

GNS3 Cannot Connect Network Interfaces when running on VMware vSphere