cc/td/doc/product/iaabu/pix
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

PIX Firewall Series Version 4.1.2
Release Notes

PIX Firewall Series Version 4.1.2
Release Notes

September 15, 1997

Cisco's PIX Firewall provides firewall and network translation services.

The following topics are covered in these release notes:

Important Notes

Note Before installing version 4.1, save your configuration on floppy disk and write down your license activation key value. You must have a copy of your activation key number to restore a previous version from floppy disk.
Note PIX Firewall only supports configuration upgrades from version 4.0.x.
Note PIX Firewall version 4.1.1 was released internally only.
Note Three Ethernet network interfaces are supported currently. Two Token-Ring interfaces are supported or three as an EFT (Extended Field Test) option. In addition, PIX Firewall supports only two interfaces if you mix Ethernet and Token-Ring interfaces.
Note The PIX Firewall now has case-sensitive passwords, SNMP strings, and interface names.
Note RADIUS is only supported for authentication and not for authorization.
Note The HTML Configuration Manager is being obsoleted in a future release and has not been updated for use with the version 4.1 third interface feature. If your PIX Firewall has two network interfaces, it will work correctly. Information on the HTML Configuration Manager is provided only in these release notes. This feature is being replaced by the new PIX Firewall Manager which is being enhanced in a future release to directly configure a PIX Firewall in the same manner as the HTML Configuration Manager.
Note The aaa authorization command syntax was incorrect in the early version 4.1 documentation. The IP address from which authorization originates is shown as
the dest_ip parameter but should be source_ip.
Note Net statics now take precedence over use of the nat 1 0 0 and global command pair. This means that nat 1 0 0 only grants outbound access to hosts not specified in the net static statement.

Version 4.1.2 Features

Version 4.1.2 introduces a new set of options for the static command and fixes bugs from previous PIX Firewall versions.

New static Command Option

The syntax for the static command is:

static [(internal_if_name, external_if_name)] global_ip local_ip [max_conns [em_limit]]
[options]

Syntax Description

internal_if_name The internal network interface name.
external_if_name The external network interface name.
global_ip A global IP address. This address cannot be a PAT (port address translation)
IP address.
local_ip The local IP address from the inside network.
max_conns The maximum number of TCP connections allowed for this static. Use the show conn command to view how TCP connections are being used in the firewall.
em_limit The embryonic connection limit.
options Specify one option, or two options separated with a comma from the following:

  • norandomseq--Do not randomize the TCP/IP packet's sequence number. Only use this option if another inline firewall is also randomizing sequence numbers and the result is scrambling the data. Use of this option opens a security hole in the PIX Firewall.

  • classa | classb | classc--Specify that global_ip is a Class A, Class B, or Class C
    IP address. Class A addresses start with 1 through 127, Class B addresses start with 128 through 191, and Class C addresses start with 192 and higher.

For example, norandomseq,classa. (Do not put a space after the comma.)

Usage Guidelines

The static command creates a permanent mapping (called a static translation slot or "xlate") between a local IP address and a global IP address. For outbound connections, use static to specify an address in the pool of global addresses that is always used for translation between the local host and the global address. For inbound connections, use static with the conduit command to identify addresses visible on the external network. For inbound connections, do not use a global IP address created with the global command.

Refer to the static command page in the PIX Firewall Series Configuration Guide for more details on how to use the static command.

For version 4.1.2, the static command determines the network mask of network statics by the class option or by the number in the first octet of the global IP address. The class option overrides the number in the first octet. This feature lets you change the class of a global IP address; for example, you can use 192.0.0.0 as a Class A address even though its first octet indicates it is a Class C address.

If the address is all zeros where the net mask is zero, then the address is a net address.

IP Address Classes

IP address classes are defined as follows:

Examples

If the global_ip address is a net address, then the static is presumed to be a net static, and the net mask is the mask for the global_ip address. The local_ip address must follow the global_ip address; if the global address is a Class B net address, then the local_ip address must also be a net address, using a Class B net mask. For example, the following command is a net static:

	static (inside,outside) 172.16.0.0 172.8.0.0 0 0

The global_ip is 172.16.0.0. The first octet is 172, and that makes the net mask 255.255.0.0 (a
Class B net mask). When a net mask of 255.255.0.0 is applied to the local_ip address, we find that it is also a net address. It does not matter that the first octet in the local_ip is a Class B address; the only thing that counts is the value of the first octet of the global_ip. 

	static (inside, outside) 172.16.0.0 10.8.0.0 0 0

In this command, the local_ip address, 10.8.0.0, is a Class A address, but the mask is taken from the global_ip address, which is a Class B address, so the net mask is 255.255.0.0. Using that mask, 10.8.0.0 is a net address.

	static (inside,outside) 172.16.0.0 192.168.5.0 0 0

This command is an error, and is rejected. The global address is a Class B net address. Using a
Class B net mask, the local_ip is a host address, not a net address. It is irrelevant that 192.168.5.0 is a Class C address, as determined by its first octet, 192. It also does not matter that 192.168.5.0, under most conditions, would be considered a Class C network address. What matters is that the global address indicates that static use a Class B net mask. Using that mask, 172.16.0.0 is a net address and 192.168.5.0 is a host address, and PIX Firewall disallows a static command where the global_ip is a host address and local_ip is a net address or vice versa.

Using the class Option

To specify a net mask different than the mask specified by the global_ip address, use the class option. This option overrides the net mask implied by the first octet of the global_ip.

For example, if you have three Class C networks, 10.0.0.0, 10.2.0.0, and 10.3.4.0, and want to create a net static for the first one only, use the following command:

	static (inside,outside) 10.0.0.0 10.0.0.0 0 0 classc

The class option lets you permit access to some hosts in a network and deny access to others as shown in this example:

static (inside,outside) 10.0.0.0 10.0.0.0 0 0 classc 	
conduit (inside,outside) 10.0.0.0 0 tcp 0 0 	
conduit (inside,outside) 10.0.0.0 0 udp 0 0

Without the classc option, the command would build a static and a conduit for 10.n.n.n; and allow TCP access to both 10.0.0.5 and 10.2.0.3. With the classc option, the command builds a static and a conduit for 10.0.0.n. This then permits outside TCP access to 10.0.0.5, but denies access to 10.2.0.3.

Usage Rules Summary

The following usage rules apply:

Version 4.1.2 Bug Fixes

The following bugs were fixed in version 4.1.2:

conduit (inside, outside) global_ip 1723 tcp foreign_ip mask
conduit (inside, outside) global_ip 1723 pptp foreign_ip mask

Version 4.1 Features

PIX Firewall version 4.1 contains the following features:

Version 4.1 Command Changes

The following changes occurred in the PIX Firewall command set:

Usage Notes

The following usage notes apply to all PIX Firewall version 4 releases:

Translation Slot (xlate) Flag Description
a Passive mode FTP detected on inbound connection.
A Passive mode FTP detected on outbound connection.
B Inbound-only connection.
d Marked to be dumped (cleaned up).
f Expecting a fragmented IP packet.
h HTTP connection.
i Port address translation ICMP echo.
I Identity connection. The identity feature is started with the nat 0 command.
N Network static xlate.
n The IP packet sequence number has not been randomized. This occurs when the norandomseq option is used with the nat and the static commands.
o FTP port command received on an outbound connection.
O Port-out received.
p Port-in transmitted.
P Port-out transmitted.
r Port address translation (PAT) xlate.
s Connection uses a static.
S SMTP connection.
v Passive mode FTP started.

Step 1 Use the show config command to view the encrypted form of the privileged mode password. You must enter the text representation of the encrypted password in version 3 to access privileged mode.

Step 2 Remove the aaa commands from your configuration.

Step 3 Reload version 3 software.

Step 4 Add the appropriate auth commands back in.

SYSLOG Message Usage Notes

You can use the following guidelines to interpret SYSLOG messages:

HTML Configuration Manager

Because the http command will be removed in the near future, the information is provided in these release notes and not in the PIX Firewall Series Configuration Guide.

Note The HTML Configuration Manager has not been updated for the third interface changes and may provide unexpected information displays.

Configuring with the HTML Configuration Manager

The PIX Firewall provides a graphical user interface to help simplify configuration tasks.

Once you have specified the network interface speed and IP addresses, you need to enter two additional commands and you can then use a network browser, such as Netscape Navigator, to complete the configuration. You can have up to 16 simultaneous HTTP console sessions.

Use the http command (described in the next section) to give access to a workstation and ensure that the firewall has an IP address other than the default 0.0.0.0 value.

To access the PIX Firewall from a network browser:

Step 1 At your workstation, start a network browser.

Step 2 Open a URL and specify the IP address of the PIX Firewall's inside IP address.

Step 3 The network browser then prompts you for a user name and password. Always use admin for the user name and enter the password you specified with the passwd command. The default password is cisco.

The main configuration screen then appears. You can then configure information as needed.


http command

Provide or remove access to the PIX Firewall console HTML management interface. (Privileged mode.)

[no] http ip_address [netmask] clear http ip_address [netmask] show http
Syntax Description
ip_address IP address of systems on the inside of the PIX Firewall that are able to access the PIX Firewall HTML management interface.
netmask Network mask of ip_address. To limit access to a single IP address, use 255 in each octet; for example, 255.255.255.255. If you do not specify netmask, it defaults to 255.255.255.255 regardless of the class of ip_address.
Usage Guidelines

The http command lets an IP address access the PIX Firewall console HTML management interface. Use no http or clear http to disable management interface access. Use show http to list the information you entered. Up to 16 HTTP console sessions can be simultaneously active.

When you start the web browser, specify the IP address of the firewall in the Go to field or the Open URL field. You must have previously given the firewall an IP address and default route. In addition, if the computer on which you run the browser is directly connected to the PIX Firewall, the computer must be on the same subnet as the firewall.

If the browser displays an error message stating "Document contains no data," the http command has not been used to give that computer access to the firewall.

Note You must use the http command before you can use the PIX Firewall HTML network browser configuration capability.

The HTTP user name is admin and the default password is cisco. The user name cannot be changed.
Example
pixfirewall(config)# http 192.168.42.42
pixfirewall(config)# show http
                    192.168.42.42 255.255.255.255*

Version 4 Bug Fix History

The following bugs have been fixed in version 4 to date:

Cisco Connection Online

Cisco Connection Online (CCO) is Cisco Systems' primary, real-time support channel. Maintenance customers and partners can self-register on CCO to obtain additional information and services.

Available 24 hours a day, 7 days a week, CCO provides a wealth of standard and value-added services to Cisco's customers and business partners. CCO services include product information, product documentation, software updates, release notes, technical tips, the Bug Navigator, configuration notes, brochures, descriptions of service offerings, and download access to public and authorized files.

CCO serves a wide variety of users through two interfaces that are updated and enhanced simultaneously: a character-based version and a multimedia version that resides on the World Wide Web (WWW). The character-based CCO supports Zmodem, Kermit, Xmodem, FTP, and Internet e-mail, and it is excellent for quick access to information over lower bandwidths. The WWW version of CCO provides richly formatted documents with photographs, figures, graphics, and video, as well as hyperlinks to related information.

You can access CCO in the following ways:

For a copy of CCO's Frequently Asked Questions (FAQ), contact cco-help@cisco.com. For additional information, contact cco-team@cisco.com.

Note If you are a network administrator and need personal technical assistance with a Cisco product that is under warranty or covered by a maintenance contract, contact Cisco's Technical Assistance Center (TAC) at 800 553-2447, 408 526-7209, or tac@cisco.com. To obtain general information about Cisco Systems, Cisco products, or upgrades, contact 800 553-6387, 408 526-7208, or cs-rep@cisco.com.



hometocprevnextglossaryfeedbacksearchhelp
Copyright 1989-1997 © Cisco Systems Inc.