Cisco Pix Firewall

Download most current software from WEB. If using a DOS/Windows PC choose the executable file (pixnnn.exe). This file has the rawrite.exe program compressed into it. The rawrite program creates a bootable floppy disk that has the latest firewall software installed. Follow the readme.txt file instructions that you get once you run the pixnnn.exe.

Get a console session established to the PIX firewall.

Configure Network Routers

• Set default routes
• Set access lists
• Set any filters

Configure the PIX Firewall

pixfirewall> enalble
Password: 

pixfirewall# configure t	- Enter configuration mode.

Identify each interface - you are forced to use the name outside for the outside interface to attain maximum security.

pixfirewall(config)# nameif ethernet0 outside security0

pixfirewall(config)# nameif ethernet1 inside security100

Assign each interface an ip address.

pixfirewall(config)# ip address inside 192.168.100.1 255.255.255.0

pixfirewall(config)# ip address outside 200.100.100.50 255.255.255.0

Specify network card speed and duplex. Auto uses automatic detection. The AUTO option exists only for ethernet.

pixfirewall(config)# interface ethernet0 auto

pixfirewall(config)# interface ethernet1 auto

This is a good place to save our work.

pixfirewall(config)# exit	--- Exit config mode.

pixfirewall # wr mem		--- Save our work.

Show a little of what we have done.

pixfirewall# sh nameif
	nameif ethernet0 outside security0
	nameif ethernet1 inside security100

Continue with the configuration

pixfirewall# config t		---- Enter configuration mode

Enable Network Address Translation for the outside interface

pixfirewall(config)# nat (inside) 1 0 0

• The number 1 is the local NAT ID (between 0 and 2 billion).
• The 0 0 is the internal IP address and subnet mask to be translated 0 stands for all

Specify NAT and PAT parameters.

pixfirewall(config)# global (outside) 1 200.100.100.100 netmask 255.255.255.0

• The number 1 is the Local NAT ID (see above nat statement)
• The address and subnet mask is the address to be used for port address translation. PAT will not work with multimedia applications and does not work with H.323 application and caching nameservers.

pixfirewall(config)# global (outside) 1 200.100.100.110-200.100.100.150 netmask 255.255.255.0

• The number 1 is the Local NAT id (see nat statement)
• The network address range and mask are used for network address translation. NAT gives a limited number of addresses. There has to be a one for one address translation for NAT to work properly.

Create a default route to the outside router

pixfirewall(config)# route outside 0 0 200.100.100.1 1

• The 0 0 stands for all ip addresses.
• The ip address is the address of the router to the ISP
• The 1 tells how many hops away the router is from the firewall.

Permit ICMP traffic through the firewall

pixfirewall(config)# conduit permit icmp any any

• check with your security policy

Set a host name for the firewall. This also sets the prompt.

pixfirewall(config)# hostname wally

Set the enable passwork for the firewall.

pixfirewall(config)# enable password snnug

Exit configuration mode and save our work

pixfirewall(config)# exit	- Exit

pixfirewall# wr mem		- Save
Building configuration...
Cryptochecksum: 975d086a f1df1506 86647656 021580bc 
[OK]

Check out the configuration

pixfirewall# sh ip address
System IP Addresses:
	ip address outside 200.100.100.50 255.255.255.0
	ip address inside 192.168.100.50 255.255.255.0
Current IP Addresses:
	ip address outside 200.100.100.50 255.255.255.0
	ip address inside 192.168.100.50 255.255.255.0

pixfirewall# sh global
global (outside) 1 200.100.100.100 netmask 255.255.255.0
global (outside) 1 200.100.100.110-200.100.100.150 netmask 255.255.255.0

pixfirewall# sh nat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

pixfirewall# sh route
	outside 0.0.0.0 0.0.0.0 200.100.100.1 1 OTHER static

pixfirewall# write t