Cisco PIX 501 User manual

Quick Start Guide
Cisco PIX 501 Firewall Quick Start Guide,
Version 6.1
1Check Items Included 3
2Connect the Cables 4
3Power On the PIX 501 5
4Check the LEDs 6
5(Optional) Install a Cable Lock 7
6(Optional) Configuration Changes 8

2
AbouttheCiscoPIX501Firewall
The Cisco PIX 501 Firewall delivers enterprise-class
security for small offices and telecommuters in a
reliable, plug-and-play security appliance. Ideal for
securing high-speed “always on” broadband
environments, the Cisco PIX 501 Firewall, part of the
market-leading Cisco PIX Firewall Series, provides
robust security capabilities, small office networking
features, and powerful remote management capabilities in a compact, all-in-one solution:
•Stateful inspection security based on state-of-the-art Adaptive Security Algorithm (ASA)
•Supports over 100 predefined applications, services, and protocols for flexible access control
•Virtual Private Networking (VPN) for secure remote network access using IKE/IPSec standards
•Intrusion protection from over 55 different network-based attacks
•URL filtering of outbound web traffic via Websense server support
•Integrated switch allows multiple users to share a single broadband connection
POWER
VPNTUNNEL
LINK/ACT
100 MBPS
1234
CISCO PIX 501
FIREWALL
Hardware Features
•Compact, desktop chassis
•External power supply
•133-MHz processor
•16-MB RAM, 8-MB Flash memory
•1 10BaseT Ethernet port (half duplex) for an
outside connection to the Internet (port 0)
•Integrated 4-port 10/100-Mbps Ethernet
switch for inside private LAN (ports 1
through 4)
•Serial console port for administrative access
•Security lock slot for added physical security
•Front panel LEDs for appliance and link
status
•10-Mbps cleartext firewall throughput
•3-Mbps VPN throughput (3DES/SHA1)
Software Features
•Supports PIX Firewall OS version 6.2 (and
later), a secure, purpose-built embedded
operating system
•Includesplug-and-playdefaultconfiguration
for simplified installation
•Includes Cisco PIX Device Manager (PDM)
for intuitive, web-based administration of
PIX Firewalls
•Supports up to 10 active hosts (an active
host is one that has passed traffic within 30
seconds, or has reserved an authentication
connection); up to 50 users with optional
50-user license
•Internal DHCP server supports up to
32 DHCP address leases; up to 128 with
optional 50-user license
•Supports 56-bit DES and 168-bit 3DES, with
o
p
tional licenses

3
1Check Items Included
POWER
43210CONSOLE 3.3V 4.5A
PIX 501
Quick Start
Guide
Safety and
Compliance
Guide
PIX 501
(800-17211-01)
PC terminal adapter
(74-0495-01)
Documentation
Power supply and cable
(US shown) (34-1776-01)
Blue console cable
(72-1259-01)
Yellow Ethernet cable
(72-1482-01)
Orange Ethernet cable
(72-3515-01)
Documentation
CD-ROM

4
2Connect the Cables
To connect the cables:
Step 1 Place the chassis on a flat, stable surface. The chassis is not rack mountable.
Step 2 Connect Port 0, the outside Ethernet port, to the public network:
•Use the yellow Ethernet cable (72-1482-01) to connect the device to a switch or hub.
•Use the orange Ethernet cable (72-3515-01) to connect the device to a DSL modem, cable
modem, or router.
Step 3 Connect your PC orother network devices to one of the four switched inside ports (numbered
1 through 4).
POWER
43210CONSOLE
3.3V4.5A
Computer or other
network device
Power
adapter
DSL/Cable/ISDN
modem
Orange
Ethernet
cable
Yellow
Ethernet
cable
PIX 501
Internet
61277
a
ptop computer Printer

5
3Power On the PIX 501
To power on the PIX 501:
Step 1 Connect the small, round connector of the power supply cable to the power connector on the
rear panel.
Step 2 Connect the AC power connector of the power supply input cable to an electrical outlet.
Note The PIX 501 does not have a power switch. Completing Step 2 powers on the
PIX 501.
POWER
43210CONSOLE
3.3V4.5A
60974
Power supply

6
4Check the LEDs
The LINK/ACT LED indicators on the front panel of the PIX 501 are normally solid green when a
link is established and flashing green when the ports are active. Each inside Ethernet interface
(1 through 4) has two LEDs to indicate the operating speed and that the physical link is established.
Note If all LEDs are operating as expected (see Table 1), this concludes the PIX 501
installation. The pages that follow include additional optional procedures.
Table 1 PIX 501 LEDs
LED State Description
POWER Green The device is powered on.
Off The device is powered off.
LINK/ACT Flashing
green Network activity, such as Internet access, is present.
Green The correct cable is in use, and the connected equipment has power.
Off No link is established.
Tip If the LINK/ACT LED does not light up, you might be
using the wrong type of cable. Try replacing the yellow
(straight-through) Ethernet cable with the orange (crossover)
Ethernet cable.
VPN TUNNEL Green One or more IKE/IPSec VPN tunnels are active.
Off No VPN tunnels are active. If the default configuration has not been
modified to support IKE/IPSec VPN tunnels, the LED does not light up
because it is disabled by default. Also, the LED does not light up when
PPTP/L2TP tunnels are established.
100 MBPS Green The interface is enabled at 100-Mbps half or full duplex
(autonegotiated).
Off The interface is enabled at 10-Mbps half or full duplex.
POWER
VPN TUNNEL
LINK/ACT
100 MBPS
1234
CISCO PIX 501
FIREWALL
61392
0

7
5(Optional) Install a Cable Lock
The PIX 501 includes a slot that accepts standard desktop cable locks to provide physical security for
small portable equipment, such as a laptop computer. The cable lock is not included with the PIX 501.
To install a cable lock:
Step 1 Attach the cable lock (not included) to the lock slot on the back panel of the PIX 501.
Step 2 Follow the directions from the manufacturer for attaching the other end of the device for
securing the PIX 501.
POWER
43210CONSOLE
3.3V4.5A
61394
Lock slot
Cable lock
(
not included
)
Cisco PIX 501

8
6(Optional) Configuration Changes
The PIX 501 is manufactured with a default configuration that meets the needs of most broadband
networking environments. The default configuration enables a DHCP client on the outside interface
and a DHCP server with a predefined IP address pool on the inside interface. For most users,
additional configuration of the PIX 501 is not necessary.
There are only a few instances when it might be necessary to change the default configuration:
•To create administrative and Telnet passwords
•To configure a static IP address for an outside interface
•To upgrade to a DES or 3DES encryption software license
•To upgrade the user license from 10 to 50 users
•To restore the default configuration
Administrative Access
There are three ways to modify the default configuration:
•PDM—Use a web browser to run PDM.
•Console—Use a serial terminal emulator from a PC or workstation connected to the Console port
for local administrative access.
•Telnet—Use PDM or a console to configure Telnet access to the PIX 501. By default, Telnet access
is not permitted. To Telnet to the PIX 501 from the outside perimeter of the firewall, configure an
outside IP address and IPSec for a secure Telnet session. For more information, refer to the
Cisco PIX Firewall and VPN Configuration Guide.

9
PDM
PDM is a web browser-based configuration tool
designed to help you set up, configure, and monitor
the PIX Firewallby use of a graphicaluser interface
(GUI). PDM is installed on the PIX 501 before it
ships to you. To use PDM, make sure JavaScript and
Java are enabled in your web browser. Then use
your web browser to create a Secure HTTP
(HTTPS), encrypted and keyed, connection to the
PIX501.For best performance,we recommend that
you use Microsoft Internet Explorer 5.0 (Service
Pack 1) or a later release. Refer to the Cisco PIX
Device Manager Installation Guide for more
information on operating system and web browser environments supported by PDM.
To load PDM:
Step 1 Verify that your PC has basic connectivity to the PIX 501 on one of the inside ports (1 through
4) using the LINK LEDs. When connectivity occurs, the LINK LEDs on both your PC and the
PIX 501 port light up solid green.
Step 2 Use your web browser to create an HTTPS connection to the inside
IP address of your PIX 501. If you are using the default configuration
and have not changed it, the inside IP address is 192.168.1.1. PDM begins to load.
Step 3 When prompted for a password, press Enter and PDM completes the loading process.

10
Connect a Console
To connect a console for local administrative access:
Step 1 Plug one end of the console cable adapter (29-0810-01) into a standard 9-pin PC serial port.
Step 2 Plug one end of the blue console cable (72-1259-01) into the console cable adapter.
Step 3 Plug the other end of the blue console cable into the Console port of the PIX 501.
Step 4 Configure the PC terminal emulation software or terminal for 9600 baud, 8 data bits, no
parity, and 1 stop bit.
Refer to the Cisco PIX Firewall and VPN Configuration Guide for information about how to use the
command-line interface (CLI).
61391
POWER
43210CONSOLE
3.3V4.5A
PC terminal adapter
(74-0495-01)
Blue console cable Cisco PIX 501

11
Create a Password
The PIX 501 includes two types of passwords:
the enable (administrative) password and a
Telnet password. There is no preconfigured
enablepassword;however,theTelnetpassword
is cisco. For improved security, we recommend
that you create an enable password and change
the Telnet password.
When creating passwords, follow these
guidelines:
•Passwords can be a maximum of
16 characters in length.
•Password characters can consist of
alphanumeric or special characters except
for the question mark or space.
•Passwords are case-sensitive, for example, an uppercase “A” is recognized differently from a
lowercase “a.”
To create passwords using PDM:
Step 1 Click the System Properties tab.
Step 2 Click PIX Administration>Password in the Categories tree. The Password panel appears that
lets you set the enable password and change the Telnet password.
Step 3 Under Enable Password, skip the Old Password box and enter the new password in the New
Password box.
Step 4 Reenter the new password in the Confirm New Password box.
Step 5 Click Apply to PIX to save the new password.
Step 6 Under Telnet Password, enter cisco in the Old Password box.
Step 7 Enter the new password in the New Password box.
Step 8 Reenter the new password in the Confirm New Password box.
Step 9 Click Apply to PIX to save the new password.

12
Set a Static IP Address
The default configuration enables DHCP for the outside
interface so that the PIX 501 can automatically obtain an IP
address from your network service provider. If you are not using
DHCP, you need to set a static IP address on the outside
interface.
To set a static IP address for the outside interface using PDM:
Step 1 Click the System Properties tab.
Step 2 Click Routing>Static Route in the Categories tree.
Step 3 Click Add and the Add Static Route dialog box appears.
Step 4 Click the Interface Name list to select the outside interface to configure. The interface name
is enabled in System Properties>Interfaces.
Step 5 In the IP Address box, enter the external network static IP address.
Step 6 In the Gateway IP box, enter the IP address of the gateway router that is the next hop address.
Step 7 In the Mask box, enter the network mask address that applies to the IP address you entered
in Step 6.
Step 8 Click OK.
Step 9 Click Apply to PIX, and the changes are applied to the running configuration.

13
Upgrade to DES, 3DES, or a 50-User License
To upgrade features you did not specify at the time of
purchase, you need to use an activation key. The
activation key allows you to add software features to
the PIX 501, such as DES, 3DES, or a 50-user license.
To request a free activation key for DES, complete the
online form at the following website:
http://www.cisco.com/kobayashi/sw-center/internet/
pix-56bit-license-request.shtml
To request an activation key for 3DES
(PIX-501-VPN-3DES=) or a 50-user license
(PIX-501-SW-10-50=), go to Cisco’s ordering website:
http://www.cisco.com/public/Ordering_root.shtml
Note Enter the activation key only after you have downloaded an image—not from the
command line or without rebooting first.
To use an activation key:
Step 1 Download a current PIX Firewall image from Cisco Connection Online (CCO) at the
following website:
http://www.cisco.com/cgi-bin/tablebuild.pl/pix
Note This step is necessary even if the PIX Firewall is running the most current image.
Step 2 Set up a TFTP server and transfer the image to the proper directory.
Step 3 Reboot the PIX Firewall by powering it off and then on again.
Step 4 Press Escape or send a BREAK signal to enter boot ROM monitor mode.
Tip You can send a BREAK signal on a Windows system with Ctrl-Break or by pressing
the Esc key.
Step 5 Enter the copy tftp flash command to download a TFTP image.
Step 6 At the install new image prompt, enter Y.
Step 7 At the enter new key prompt, enter Y.
Step 8 Enter the activation key. If the key is correct, the system boots and operates normally.

14
Active Host Limitation
The Cisco PIX 501 supports up to 10 active hosts on the inside network, or 50 active hosts on the
inside network if the optional 50-User License has been purchased. A host is considered active when
any of the following statements are true:
•The host has passed traffic through the PIX in the last 30 seconds
•The host has an established NAT/PAT translation through the PIX
•The host has an established TCP connection or UDP session through the PIX
•The host has an established user authentication through the PIX
Please see the System Properties>Timeout panel within PDM for the default inactivity timeout values
associated with each of the above bulleted items.
Restore the Default Configuration
If you inadvertently erase the default configuration or need to restore the default configuration, either
use the PDM CLI tool or a terminal emulation program and enter the following command:
Note You can restore the default configuration only through the CLI.
Note The config factory default command considers both licensing and platform in
creating DHCP pool sizes of 32, 128, or 256.
Please reference the following URL for detailed command information and configuration examples:
http://cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_61/cmd_ref/index.htm
Command Description
Step 1 config factory default [<inside ip
address> [address mask]] 1
1. If the optional inside ip address and optional address mask are specified, the factory-default configuration will reflect
the specified IP address.
Erases the running configuration and replaces it with
the factory default configuration.
Step 2 write memory Writes the factory default configuration to memory.
Step 3

15
Obtaining Documentation
The following sections provide sources for obtaining documentation from Cisco Systems.
World Wide Web
The most current Cisco PIX Firewall documentation is on the World Wide Web at the following
website:
•Technical documentation:
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/index.htm
•Product literature:
http://www.cisco.com/go/pix
The most current general selection of Cisco documentation is on the World Wide Web at the following
website:
•http://www.cisco.com
•http://www-china.cisco.com
•http://www-europe.cisco.com
Documentation CD-ROM
Cisco documentation and additional literature are available in a CD-ROM package, which ships
with your product. The Documentation CD-ROM is updated monthly and may be more current than
printed documentation. The CD-ROM package is available as a single unit or as an
annual subscription.

16
Ordering Documentation
Cisco documentation is available in the following ways:
•Registered Cisco Direct Customers can order Cisco Product documentation from the Networking
Products MarketPlace:
http://www.cisco.com/cgi-bin/order/order_root.pl
•Registered Cisco.com users can order the Documentation CD-ROM through the online
Subscription Store:
http://www.cisco.com/go/subscription
•Nonregistered Cisco.com users can order documentation through a local account representative
by calling Cisco corporate headquarters (California, USA) at 408 526-7208 or, in North America,
by calling 800 553-NETS(6387).
Obtaining Technical Assistance
Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can
obtain documentation, troubleshooting tips, and sample configurations from online tools. For
Cisco.com registered users, additional troubleshooting tools are available from the TAC website.
Cisco.com
Cisco.com is the foundation of a suite of interactive, networked services that provides immediate,open
access to Cisco information and resources at anytime, from anywhere in the world. This highly
integrated Internet application is a powerful, easy-to-use tool for doing business with Cisco.
Cisco.com provides a broad range of features and services to help customers and partners streamline
business processes and improve productivity. Through Cisco.com, you can find information about
Cisco and our networking solutions, services, and programs. In addition, you can resolve technical
issues with online technical support, download and test software packages, and order Cisco learning
materials and merchandise.
Customers and partners can self-register on Cisco.com to obtain additional personalized information
and services. Registered users can order products, check on the status of an order, access technical
support, and view benefits specific to their relationships with Cisco.
To access Cisco.com, go to the following website:
http://www.cisco.com

17
Technical Assistance Center
The Cisco TAC website is available to all customers who need technical assistance with a Cisco
product or technology that is under warranty or covered by a maintenance contract.
Contacting TAC by Using the Cisco TAC Website
If you have a priority level 3 (P3) or priority level 4 (P4) problem, contact TAC by going to the TAC
website:
http://www.cisco.com/tac
P3 and P4 level problems are defined as follows:
•P3—Your network performance is degraded. Network functionality is noticeably impaired, but
most business operations continue.
•P4—You need information or assistance on Cisco product capabilities, product installation, or
basic product configuration.
In each of the above cases, use the Cisco TAC website to quickly find answers to your questions.
To register for Cisco.com, go to the following website:
http://www.cisco.com/register/
If you cannot resolve your technical issue by using the TAC online resources, Cisco.com registered
users can open a case online by using the TAC Case Open tool at the following website:
http://www.cisco.com/tac/caseopen
Contacting TAC by Telephone
If you have a priority level 1 (P1) or priority level 2 (P2) problem, contact TAC by telephone and
immediately open a case. To obtain a directory of toll-free numbers for your country, go to the
following website:
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
P1 and P2 level problems are defined as follows:
•P1—Your production network is down, causing a critical impact to business operations if service
is not restored quickly. No workaround is available.
•P2—Your production network is severely degraded, affecting significant aspects of your business
operations. No workaround is available.

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
European Headquarters
Cisco Systems Europe
11 Rue Camille Desmoulins
92782 Issy-les-Moulineaux
Cedex 9
France
www-europe.cisco.com
Tel: [phone]
Fax: [phone]
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
www.cisco.com
Tel: [phone]
Fax: [phone]
Asia Pacific Headquarters
Cisco Systems Australia, Pty., Ltd
Level 9, 80 Pacific Highway
P.O. Box 469
North Sydney
NSW 2060 Australia
www.cisco.com
Tel: [phone]
Fax: [phone]
Cisco Systems has more than 200 offices in the following countries. Addresses, phone numbers, and fax numbers are listed on the
Cisco Web site at www.cisco.com/go/offices
Argentina • Australia • Austria • Belgium • Brazil • Bulgaria • Canada • Chile • China PRC • Colombia • Costa Rica • Croatia • Czech Republic • Denmark • Dubai, UAE
Finland • France • Germany • Greece • Hong Kong SAR • Hungary • India • Indonesia • Ireland • Israel • Italy • Japan • Korea • Luxembourg • Malaysia • Mexico
The Netherlands • New Zealand • Norway • Peru • Philippines • Poland • Portugal • Puerto Rico • Romania • Russia • Saudi Arabia • Scotland • Singapore • Slovakia
Slovenia • South Africa • Spain • Sweden • Switzerland • Taiwan • Thailand • Turkey • Ukraine • United Kingdom • United States • Venezuela • Vietnam • Zimbabwe
Copyright © 2001, Cisco Systems, Inc. All rights reserved. AccessPath, AtmDirector, Browse with Me, CCIP, CCSI, CD-PAC, CiscoLink, the Cisco Powered Network logo, Cisco
Systems Networking Academy, Fast Step, Follow Me Browsing, FormShare, FrameShare, GigaStack, IGX, Internet Quotient, IP/VC, iQ Breakthrough, iQ Expertise, iQ FastTrack,
iQ Net Readiness Scorecard, The iQ Logo, MGX, the Networkers logo, Packet, RateMUX, ScriptBuilder, ScriptShare, SlideCast, SMARTnet, TransPath, Unity, Voice LAN,
Wavelength Router, and WebViewer, are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Discover All That’s Possible, and Empowering
the Internet Generation, are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the CiscoCertified Internetwork
Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Enterprise/Solver, EtherChannel, EtherSwitch, FastHub,
FastSwitch, IOS, IP/TV, LightStream, MICA, Network Registrar, PIX, Post-Routing, Pre-Routing, Registrar, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are
registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.
All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0108R)
Printed in the USA on recycled paper containing 10% postconsumer waste.
DOC-7813481=