Network Warrior

Miscellaneous

The following items are things that trip me up again and again in the field.

Remote Access

To be able to telnet or SSH to your PIX firewall, you must specify the networks from which you will do so. This is done with the telnet and ssh commands:

PIX(config)#telnet 192.168.1.0 255.255.255.0 inside
PIX(config)# ssh 192.168.1.0 255.255.255.0 inside

Saving Configuration Changes

If you are in the habit of shortening the write memory command in IOS to wri, you will be frustrated to find that the abbreviation does not work on a PIX:

PIX#wri
Not enough arguments.
Usage:  write erase|floppy|mem|terminal|standby
        write net [<tftp_ip>]:<filename>
PIX# wri mem
Building configuration...
Cryptochecksum: f4f6sf4b 045a1327 1b4eaac1 670e1e41

The copy running startup command also does not work.

When you're configuring the active PIX in a failover pair, each command should be sent to the standby PIX automatically after it's submitted, and when you save your changes on the active PIX, the write memory command should also write the configuration to the standby PIX. To force a save to the standby PIX, use the write standby command:

PIX#write standby
Building configuration...
[OK]
PIX# Sync Started
.
Sync Completed

Note that the Sync Started entry above is not a command, but rather the output of normal PIX logging when logging is enabled.

Logging

If you have a firewall in place, you should save and periodically review the logs it generates. When configured for logging, PIX firewalls create a great deal ...