Cisco PIX 520 - PIX Firewall 520 User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco PIX Device Manager
Installation Guide
Version 3.0
Text Part Number: 78-15483-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION,LOST PROFITS OR LOSSOR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES
This document is to be used in conjunction with the appropriate documentation for your Cisco PIX Firewall system.
CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, In
Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CC
CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo,
Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net
Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Regi
ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO are regis
t
trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.
All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relations
between Cisco and any other company. (0304R)
Cisco PIX Device Manager Installation Guide
Copyright © 2003 Cisco Systems, Inc.
All rights reserved.

iii
CiscoPIX Device ManagerInstallation Guide,Version 3.0
78-15483-01
CONTENTS
Preface vii
Document Objectives vii
Audience vii
Installation Warning viii
Safety Warning Description ix
Document Organization xiii
Document Conventions xiii
Terms and Acronyms xiv
Related Documentation xv
Obtaining Documentation xv
Cisco.com xv
Documentation CD-ROM xv
Ordering Documentation xv
Documentation Feedback xvi
Obtaining Technical Assistance xvi
Cisco TAC Website xvi
Opening a TAC Case xvi
TAC Case Priority Definitions xvii
Obtaining Additional Publications and Information xvii
Overview 1 - 1
Introduction 1 - 1
Data Encryption Overview 1 - 2
PIX Firewall System Requirements 1 - 4
PIX Firewall System Interoperability with PDM 1 - 4
Flash Memory Requirements 1 - 5
Maximum Configuration File Size 1 - 5
Software Requirements 1 - 6
Upgrading toa New Software Release 1 - 6
PC/Workstation Requirements 1 - 6
Supported Platforms 1 - 8
Windows 1 - 8
Sun Solaris 1 - 9
Red Hat Linux 1 - 9

Contents
iv
Cisco PIX Device Manager Installation Guide, Version 3.0 78-15483-01
Preparing to Install PDM 2 - 1
Notes and Cautions 2 - 1
Caution 2 - 2
Installation Checklist 2 - 2
Preparing to Install PDM 2 - 3
Determining the IP Address of Your Server 2 - 4
Windows NT, Windows 2000, or Windows XP 2 - 4
Windows 98 or Windows ME 2 - 4
Sun Solaris 2 - 5
Linux 2 - 5
Installing PDM 3 - 1
Downloading the PDM Software 3 - 1
Downloading PDM from Cisco.com 3 - 1
Downloading PDM Using FTP 3 - 2
Installing PDM 3 - 2
Loading the PDM Image 3 - 4
Configuring PDM 4 - 1
Starting PDM with InternetExplorer 4 - 1
Starting PDM with Netscape Navigator 4 - 2
PDM Home Page 4 - 3
Using the PDM Startup Wizard 4 - 4
VPN Wizard 4 - 5
Site-to-Site VPN 4 - 5
Remote Access VPN 4 - 5
Select Interface 4 - 6
Configuring VPN Tunnels 4 - 6
Configuration Recommendations 4 - 6
Tips and Troubleshooting 5 - 1
Checking Your Connection to the PIX Firewall 5 - 1
Tips on Using PDM 5 - 2
Troubleshooting 5 - 3
Using a TFTP Server A -1
Obtaining a Windows TFTP Server A - 1
Enabling UNIX TFTP Support A - 2
Enabling TFTP Access on a Sun Solaris System A - 2

Contents
v
CiscoPIX Device ManagerInstallation Guide,Version 3.0
78-15483-01
Enabling TFTP Access on a Linux System A - 2
TFTP Download Error Codes A - 3
I NDEX

Contents
vi
Cisco PIX Device Manager Installation Guide, Version 3.0 78-15483-01

vii
Cisco PIX Device Manager Installation Guide
78-15483-01
Preface
This preface includes the following sections:
•Document Objectives, page vii
•Audience, page vii
•Installation Warning, page viii
•Installation Warning, page viii
•Document Organization, page xiii
•Document Conventions, page xiii
•Terms and Acronyms, page xiv
•Related Documentation, page xv
•Obtaining Documentation, page xv
•Obtaining Technical Assistance, page xvi
•Obtaining Additional Publications and Information, page xvii
Document Objectives
This guide describes how to install and access the Cisco PIX Device Manager (PDM) software.
Audience
This guide is for network administrators who perform the following:
•Manage network security
•Install and configure firewalls

viii
Cisco PIX Device Manager Installation Guide 78-15483-01
Preface
Installation Warning
Installation Warning
Warning Only trained and qualified personnel should be allowed to install, replace, or service
this equipment.
Waarschuwing
Deze apparatuur mag alleen worden geïnstalleerd, vervangen of hersteld door bevoegd
geschoold personeel.
Varoitus
Tämän laitteen saa asentaa, vaihtaa tai huoltaa ainoastaan koulutettu ja laitteen
tunteva henkilökunta.
Attention
Il est vivement recommandé de confier l'installation, le remplacement et la maintenance de ces
équipements à des personnels qualifiés et expérimentés.
Warnung
Das Installieren, Ersetzen oder Bedienen dieser Ausrüstung sollte nur geschultem, qualifiziertem
Personal gestattet werden.
Figyelem!
A berendezést csak szakképzett személyek helyezhetik üzembe, cserélhetik és tarthatják karban.
Avvertenza
Questo apparato può essere installato, sostituito o mantenuto unicamente da un personale
competente.
Advarsel
Bare opplært og kvalifisert personell skal foreta installasjoner, utskiftninger eller service på
dette utstyret.
Aviso
Apenas pessoal treinado e qualificado deve ser autorizado a instalar, substituir ou fazer a revisão
deste equipamento.
¡Advertencia!
Solamente el personal calificado debe instalar, reemplazar o utilizar este equipo.
Varning!
Endast utbildad och kvalificerad personal bör få tillåtelse att installera, byta ut eller reparera
denna utrustning.

ix
Cisco PIX Device Manager Installation Guide
78-15483-01
Preface Safety Warning Description
Safety Warning Description
Warning IMPORTANT SAFETY INSTRUCTIONS
This warning symbol means danger. You are in a situation thatcould cause bodily injury. Beforeyou
work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar
with standard practicesfor preventingaccidents. To see translations of the warnings thatappearin
this publication, refer to the translated safety warnings that accompanied this device.
Note: SAVE THESE INSTRUCTIONS
Note: This documentation is to be used in conjunction with the specific product installation guide
that shipped with the product. Please refer to the Installation Guide, Configuration Guide, or other
enclosed additional documentation for further details.
Waarschuwing
BELANGRIJKE VEILIGHEIDSINSTRUCTIES
Dit waarschuwingssymbool betekent gevaar. U verkeert in een situatie die lichamelijk letsel kan
veroorzaken. Voordat u aan enige apparatuur gaat werken, dient u zich bewust te zijn van de bij
elektrische schakelingen betrokken risico's en dient u op de hoogte te zijn van de standaard
praktijken om ongelukken te voorkomen. Voor een vertaling van de waarschuwingen die in deze
publicatie verschijnen, dient u de vertaalde veiligheidswaarschuwingen te raadplegen die bij dit
apparaat worden geleverd.
Opmerking BEWAAR DEZE INSTRUCTIES.
Opmerking Deze documentatie dient gebruikt te worden in combinatie met de
installatiehandleiding voor het specifieke product die bij het product wordt geleverd. Raadpleeg de
installatiehandleiding, configuratiehandleiding of andere verdere ingesloten documentatie voor
meer informatie.
Varoitus
TÄRKEITÄ TURVALLISUUTEEN LIITTYVIÄ OHJEITA
Tämä varoitusmerkki merkitsee vaaraa. Olet tilanteessa, joka voi johtaa ruumiinvammaan. Ennen
kuin työskentelet minkään laitteiston parissa, ota selvää sähkökytkentöihin liittyvistä vaaroista ja
tavanomaisista onnettomuuksien ehkäisykeinoista. Tässä asiakirjassa esitettyjen varoitusten
käännökset löydät laitteen mukana toimitetuista ohjeista.
Huomautus SÄILYTÄ NÄMÄ OHJEET
Huomautus Tämä asiakirja on tarkoitettu käytettäväksi yhdessä tuotteen mukana tulleen
asennusoppaan kanssa. Katso lisätietoja asennusoppaasta, kokoonpano-oppaasta ja muista
mukana toimitetuista asiakirjoista.

x
Cisco PIX Device Manager Installation Guide 78-15483-01
Preface
Safety Warning Description
Attention
IMPORTANTES INFORMATIONS DE SÉCURITÉ
Cesymboled'avertissementindiqueundanger. Vousvoustrouvezdansune situationpouvant causer
des blessures ou des dommages corporels. Avant de travailler sur un équipement, soyez conscient
desdangersposésparlescircuitsélectriquesetfamiliarisez-vousaveclesprocédurescouramment
utilisées pour éviter les accidents. Pour prendre connaissance des traductions d'avertissements
figurantdanscette publication, consultezlesconsignesde sécuritétraduitesqui accompagnentcet
appareil.
Remarque CONSERVEZ CES INFORMATIONS
Remarque Cette documentation doit être utilisée avec le guide spécifique d'installation du produit
qui accompagne ce dernier. Veuillez vous reporter au Guide d'installation, au Guide de
configuration, ou à toute autre documentation jointe pour de plus amples renseignements.
Warnung
WICHTIGE SICHERHEITSANWEISUNGEN
Dieses Warnsymbol bedeutet Gefahr. Sie befinden sich in einer Situation, die zu einer
Körperverletzung führen könnte. Bevor Sie mit der Arbeit an irgendeinem Gerät beginnen, seien Sie
sich der mit elektrischen Stromkreisen verbundenen Gefahren und der Standardpraktiken zur
Vermeidung von Unfällen bewusst. Übersetzungen der in dieser Veröffentlichung enthaltenen
Warnhinweise sind im Lieferumfang des Geräts enthalten.
Hinweis BEWAHREN SIE DIESE SICHERHEITSANWEISUNGEN AUF
Hinweis Dieses Handbuch ist zum Gebrauch in Verbindung mit dem Installationshandbuch für Ihr
Gerät bestimmt, das dem Gerät beiliegt. Entnehmen Sie bitte alle weiteren Informationen dem
Handbuch (Installations- oder Konfigurationshandbuch o. Ä.) für Ihr spezifisches Gerät.
Figyelem!
FONTOS BIZTONSÁGI ELÕÍRÁSOK
Ez a figyelmezetõ jel veszélyre utal. Sérülésveszélyt rejtõ helyzetben van. Mielõtt bármely
berendezésen munkát végezte, legyen figyelemmel az elektromos áramkörök okozta kockázatokra,
és ismerkedjen meg a szokásos balesetvédelmi eljárásokkal. A kiadványban szereplõ
figyelmeztetések fordítása a készülékhez mellékelt biztonsági figyelmeztetések között található.
Megjegyzés ÕRIZZE MEG EZEKET AZ UTASÍTÁSOKAT!
Megjegyzés Ezt adokumentációt akészülékhez mellékelt üzembehelyezésiútmutatóvalegyütt kell
használni. További tudnivalók a mellékelt Üzembe helyezési útmutatóban (Installation Guide),
Konfigurációs útmutatóban (Configuration Guide) vagy más dokumentumban találhatók.
Avvertenza
IMPORTANTI ISTRUZIONI SULLA SICUREZZA
Questo simbolo di avvertenza indica un pericolo. La situazione potrebbe causare infortuni alle
persone. Prima di intervenire su qualsiasi apparecchiatura, occorre essere al corrente dei pericoli
relativi ai circuiti elettrici econoscere leprocedure standard perlaprevenzionediincidenti. Per le
traduzioni delle avvertenze riportate in questo documento, vedere le avvertenze di sicurezza che
accompagnano questo dispositivo.
Nota CONSERVARE QUESTE ISTRUZIONI
Nota La presente documentazione va usata congiuntamente alla guida di installazione specifica
spedita con il prodotto. Per maggiori informazioni, consultare la Guida all'installazione, la Guida
alla configurazione o altra documentazione acclusa.

xi
Cisco PIX Device Manager Installation Guide
78-15483-01
Preface Safety Warning Description
Advarsel
VIKTIGE SIKKERHETSINSTRUKSJONER
Dette varselssymbolet betyr fare. Du befinner deg i en situasjon som kan forårsake personskade.
Før du utfører arbeid med utstyret, bør du være oppmerksom på farene som er forbundet med
elektriske kretssystemer, og du bør være kjent med vanlig praksis for å unngå ulykker. For å se
oversettelser av advarslene i denne publikasjonen, se de oversatte sikkerhetsvarslene som følger
med denne enheten.
Merk TA VARE PÅ DISSE INSTRUKSJONENE
Merk Denne dokumentasjonen skal brukes i forbindelse med den spesifikke
installasjonsveiledningen som fulgte med produktet. Vennligst se installasjonsveiledningen,
konfigureringsveiledningen eller annen vedlagt tilleggsdokumentasjon for detaljer.
Aviso
INSTRUÇÕES IMPORTANTES DE SEGURANÇA
Este símbolo de aviso significa perigo. O utilizador encontra-se numa situação que poderá ser
causadora de lesões corporais. Antes de iniciar a utilização de qualquer equipamento, tenha em
atenção os perigos envolvidos no manuseamento de circuitos eléctricos e familiarize-se com as
práticas habituais de prevenção de acidentes. Para ver traduções dos avisos incluídos nesta
publicação, consulte os avisos de segurança traduzidos que acompanham este dispositivo.
Nota GUARDE ESTAS INSTRUÇÕES
Nota Esta documentação destina-se a ser utilizada em conjunto com o manual de instalação
incluído com o produto específico. Consulte o manual de instalação, o manual de configuração ou
outra documentação adicional inclusa, para obter mais informações.
¡Advertencia!
INSTRUCCIONES IMPORTANTES DE SEGURIDAD
Este símbolo de aviso indica peligro. Existe riesgo para su integridad física. Antes de manipular
cualquier equipo, considere los riesgos de la corriente eléctrica y familiarícese con los
procedimientos estándar de prevención de accidentes. Vea las traducciones de las advertencias
que acompañan a este dispositivo.
Nota GUARDE ESTAS INSTRUCCIONES
Nota Esta documentación está pensada para ser utilizada con la guía de instalación del producto
que lo acompaña. Si necesita más detalles, consulte la Guía de instalación, la Guía de
configuración o cualquier documentación adicional adjunta.
Varning!
VIKTIGA SÄKERHETSANVISNINGAR
Denna varningssignal signalerar fara. Du befinner dig i en situation som kan leda till personskada.
Innan du utför arbete på någon utrustning måste du vara medveten om farorna med elkretsar och
känna till vanliga förfaranden för att förebygga olyckor. Se översättningarna av de
varningsmeddelanden som finnsi denna publikation, ochse deöversatta säkerhetsvarningarnasom
medföljer denna anordning.
OBS! SPARA DESSA ANVISNINGAR
OBS! Denna dokumentation ska användas i samband med den specifika
produktinstallationshandbok som medföljde produkten. Se installationshandboken,
konfigurationshandboken eller annan bifogad ytterligare dokumentation för närmare detaljer.

xii
Cisco PIX Device Manager Installation Guide 78-15483-01
Preface
Safety Warning Description

xiii
Cisco PIX Device Manager Installation Guide
78-15483-01
Preface Document Organization
Document Organization
The major sections of this guide are as follows:
Document Conventions
Command descriptions use these conventions:
•Braces ({ }) indicate a required choice.
•Square brackets ([ ]) indicate optional elements.
•Vertical bars ( | ) separate alternative, mutually exclusive elements.
•Boldface indicates commands and keywords that are entered literally as shown.
•Italics indicate arguments for which you supply values.
Examples use these conventions:
•Examples depict screen displays and the command line in screen font.
•Information you need to enter in examples is shown in boldface screen font.
•Variables for which you must supply a value are shown in italic screen font.
Graphic user interface access uses these conventions:
•Boldface indicates buttons and menu items.
•Selecting a menu item (or screen) is indicated by the following convention:
Click Start >Settings>Control Panel.
Notes, cautionary statements, and safety warnings use these conventions:
Note Means reader take note. Notes contain helpful suggestions or references to materials not contained in
this manual.
Caution Means reader be careful. You are capable of doing something that might result in equipment damage or
loss of data.
Chapter Title Description
1Overview Physical properties and functional overview of the Cisco PIX Device Manager
(PDM) Version 3.0
2Preparing to Install PDM Preparations and other requirements before installing the PIX Firewall
3Installing PDM Installing the hardware and connecting the external network interface cables
4Configuring PDM Configuring PDM, using the PDM Wizard, including VPN Wizard and
configuration recommendations
5Tips and Troubleshooting Basic troubleshooting procedures for the hardware installation
AUsing a TFTP Server How to use a TFTP server to access PIX Firewall or PDM images

xiv
Cisco PIX Device Manager Installation Guide 78-15483-01
Preface
Terms and Acronyms
Terms and Acronyms
To fully understand the content of this user guide, you should be familiar with the following terms and
acronyms:
•AAA—authentication, authorization, and accounting
•AES— Advanced Encryption Standard
•CA—certification authority
•CEP—Certificate Enrollment Protocol
•CLI—Command-Line Interface
•CSPM—Cisco Secure Policy Manager
•DES—Data Encryption Standard
•3DES—Triple DES
•Explicit IV—Explicit Initialization Vector
•Gb—Gigabit
•Gbps—Gigabits per second
•ICMP—Internet Control Message Protocol
•IKE—Internet Key Exchange
•ISAKMP—Internet Security Association and Key Management Protocol
•IDS—Intrusion Detection System
•JVM—Java Virtual Machine
•MB—Megabyte
•Mbps—Megabits per second
•MD5—Message Digest 5 (MD5)
•PCI—Peripheral Component Interconnect
•PDM—PIX Device Manager
•PIX—PIX Firewall
•SCEP—Simple Certificate Enrollment Protocol
•SDRAM—Synchronous Dynamic Random-Access Memory
•SHA—Secure Hash Algorithm
•SNMP—Simple Network Management Protocol
•SSL—Secure Sockets Layer
•TFTP—Trivial File Transfer Protocol
•VAM—Virtual Private Network (VPN) Acceleration Module (VAM)

xv
Cisco PIX Device Manager Installation Guide
78-15483-01
Preface Related Documentation
Related Documentation
Use this document with the PIX Firewall and PDM documentation sets, which are available on the PIX
Firewall product CD and online at the following website:
http://www.cisco.com/en/US/products/sw/secursw/ps2120/prod_technical_documentation.html
Obtaining Documentation
Cisco provides several ways to obtain documentation, technical assistance, and other technical
resources. These sections explain how to obtain technical information from Cisco Systems.
Cisco.com
You can access the most current Cisco documentation on the World Wide Web at this URL:
http://www.cisco.com/univercd/home/home.htm
You can access the Cisco website at this URL:
http://www.cisco.com
International Cisco websites can be accessed from this URL:
http://www.cisco.com/public/countries_languages.shtml
Documentation CD-ROM
Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM
package, which may have shipped with your product. The Documentation CD-ROM is updated regularly
and may be more current than printed documentation. The CD-ROM package is available as a single unit
or through an annual or quarterly subscription.
Registered Cisco.com users can order a single Documentation CD-ROM (product number
DOC-CONDOCCD=) through the Cisco Ordering tool:
http://www.cisco.com/en/US/partner/ordering/ordering_place_order_ordering_tool_launch.html
All users can order annual or quarterly subscriptions through the online Subscription Store:
http://www.cisco.com/go/subscription
Ordering Documentation
You can find instructions for ordering documentation at this URL:
http://www.cisco.com/univercd/cc/td/doc/es_inpck/pdi.htm
You can order Cisco documentation in these ways:
•Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from
the Networking Products MarketPlace:
http://www.cisco.com/en/US/partner/ordering/index.shtml

xvi
Cisco PIX Device Manager Installation Guide 78-15483-01
Preface
Obtaining Technical Assistance
•Nonregistered Cisco.com users can order documentation through a local account representative by
calling Cisco Systems Corporate Headquarters (California, USA.) at 408 526-7208 or, elsewhere in
North America, by calling 800 553-NETS (6387).
Documentation Feedback
You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click
Feedback at the top of the page.
You can send your comments in e-mail to [e-mail].
You can submit comments by using the response card (if present) behind the front cover of your
document or by writing to the following address:
Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883
We appreciate your comments.
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, the Cisco
Technical Assistance Center (TAC) provides 24-hour, award-winning technical support services, online
and over the phone. Cisco.com features the Cisco TAC website as an online starting point for technical
assistance.
Cisco TAC Website
The Cisco TAC website (http://www.cisco.com/tac) provides online documents and tools for
troubleshooting and resolving technical issues with Cisco products and technologies. The Cisco TAC
website is available 24 hours a day, 365 days a year.
Accessing all the tools on the Cisco TAC website requires a Cisco.com user ID and password. If you
have a valid service contract but do not have a login ID or password, register at this URL:
http://tools.cisco.com/RPF/register/register.do
Opening a TAC Case
The online TAC Case Open Tool (http://www.cisco.com/tac/caseopen) is the fastest way to open P3 and
P4 cases. (Your network is minimally impaired or you require product information). After you describe
yoursituation, the TAC CaseOpen Tool automatically recommends resources for an immediatesolution.
If your issue is not resolved using these recommendations, your case will be assigned to a Cisco TAC
engineer.
For P1 or P2 cases (your production network is down or severely degraded) orif you do not have Internet
access, contact Cisco TAC by telephone. Cisco TAC engineers are assigned immediately to P1 and P2
cases to help keep your business operations running smoothly.

xvii
Cisco PIX Device Manager Installation Guide
78-15483-01
Preface Obtaining Additional Publications and Information
To open a case by telephone, use one of the following numbers:
Asia-Pacific: [phone] (Australia: 1 800 805 227)
EMEA: [phone]
USA: 1 800 553-2447
For a complete listing of Cisco TAC contacts, go to this URL:
http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
TAC Case Priority Definitions
To ensure that all cases are reported in a standard format, Cisco has established case priority definitions.
Priority 1 (P1)—Your network is “down” or there is a critical impact to your business operations. You
and Cisco will commit all necessary resources around the clock to resolve the situation.
Priority 2 (P2)—Operation of an existing network is severely degraded, or significant aspects of your
business operation are negatively affected by inadequate performance of Cisco products. You and Cisco
will commit full-time resources during normal business hours to resolve the situation.
Priority 3 (P3)—Operational performance of your network is impaired, but most business operations
remain functional. You and Cisco will commit resources during normal business hours to restore service
to satisfactory levels.
Priority 4 (P4)—You require information or assistance with Cisco product capabilities, installation, or
configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online
and printed sources.
•The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as
ordering and customer support services. Access the Cisco Product Catalog at this URL:
http://www.cisco.com/en/US/products/products_catalog_links_launch.html
•Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new
and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking
Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design
Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL:
http://www.ciscopress.com
•Packet magazine is the Cisco quarterly publication that provides the latest networking trends,
technology breakthroughs, and Cisco products and solutions to help industry professionals get the
most from their networking investment. Included are networking deployment and troubleshooting
tips, configuration examples, customer case studies, tutorials and training, certification information,
and links to numerous in-depth online resources. You can access Packet magazine at this URL:
http://www.cisco.com/go/packet
•iQ Magazine is the Cisco bimonthly publication that delivers the latest information about Internet
business strategies for executives. You can access iQ Magazine at this URL:
http://www.cisco.com/go/iqmagazine

xviii
Cisco PIX Device Manager Installation Guide 78-15483-01
Preface
Obtaining Additional Publications and Information
•Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering
professionals involved in designing, developing, and operating public and private internets and
intranets. You can access the Internet Protocol Journal at this URL:
http://www.cisco.com/en/US/about/ac123/ac147/about_cisco_the_internet_protocol_journal.html
•Training—Cisco offers world-class networking training. Current offerings in network training are
listed at this URL:
http://www.cisco.com/en/US/learning/index.html

CHAPTER
1-1
Cisco PIX Device Manager Installation Guide
78-15483-01
1
Overview
This chapter describes the Cisco PIX Device Manager (PDM) Version 3.0 and the system requirements
for this version.
Note In this guide, the term “PIX Firewall” refers to all models running PIX Firewall software Version 6.3
unless specifically noted. PIX Firewall software Version 6.3 is required for PDM Version 3.0.
This chapter includes the following sections:
•Introduction, page 1
•Data Encryption Overview, page 2
•PIX Firewall System Requirements, page 4
•PC/Workstation Requirements, page 6
Introduction
Cisco PIX Device Manager (PDM) is a graphical user interface (GUI) that manages Cisco PIX Firewalls.
PDM, a signed Java applet, uses certificates and HTTPS (HTTP over SSL) to securely transmit
information between PDM and the PIX Firewall. (Enter “https” in your browser to use HTTPS.)
PDM provides the following:
•GUI—Lets you configure, manage, and monitor security policies across a network.
•PDM Startup Wizard—Creates a basic configuration that allows packets to flow securely through
the PIX Firewall from the inside to the outside network.
•VPN Wizard—Creates a basic configuration that lets you easily set up a remote access VPN or
site-to-site VPN.
•Monitoring and Reporting Tools—Provides real-time and historical data, summarizing network
activity, resource utilizationand event logs, allowing performance and trend analysis. You candetect
and interrupt unusual activity with PDM’s logging and notification.
•Graphical Tools—Creates graphical summary reports showing real-time usage, security events, and
network activity. Data from each graph can be displayed in increments you select (10 second
snapshot, last 10 minutes, last 60 minutes, last 12 hours, last 5 days) and refreshed at user-defined
intervals. You can view multiple graphs simultaneously to do side-by-side analysis.
– System graphs: Provides detailed status information on the PIX Firewall, including blocks used
and free, current memory utilization, and CPU utilization.

1-2
Cisco PIX Device Manager Installation Guide 78-15483-01
Chapter1 Overview
Data Encryption Overview
– Connection graphs: Tracks real-time session and performance monitoring data for connections,
address translations, authentication, authorization, and accounting (AAA) transactions, URL
filtering requests, and more on a per-second basis.
– Intrusion Detection System (IDS): Provides 16 different graphs to display potentially malicious
activity. IDS-based signature information displays activity such as IP attacks, Internet Control
Message Protocol (ICMP) requests, and Portmap requests.
– Interface graphs: Provides real-time monitoring of your bandwidth usage for each interface.
Bandwidth usage is displayed for incoming and outgoing communications, such as packet rates,
counts, and errors, as well as bit, byte, and collision counts.
•Syslog Viewer—Lets you view specific syslog message types by selecting the desired logging level.
•Embedded Architecture—Lets you manage the Cisco PIX Firewall from almost any computer,
regardless of the operating system, and works with most browsers, including Microsoft Internet
Explorer and Netscape Navigator. There is no application to install and no plug-in required.
•Secure Communication—Supports the Secure Sockets Layer (SSL) protocol to provide high-grade
encryption from the PIX Firewall to a browser. PDM to PIX Firewall communication is securely
encrypted according to these encryption standards: 56-bit Data Encryption Standard (DES), 168-bit
Triple DES (3DES), or 128-bit Advanced Encryption Standard (AES). You can protect access with
a valid username and password, either on the PIX Firewall or through an authentication server.
Data Encryption Overview
This section describes data encryption, including the IPSec, IKE, and certification authority (CA)
interoperability features.
Note For additional information on these features, refer to the “IP Security and Encryption” chapter in the
appropriate Security Configuration Guide and Security Command Reference publications for your
specific PIX Firewall.
IPSec is a network level open standards framework, developed by the Internet Engineering Task Force
(IETF) that provides secure transmission of sensitive information over unprotected networks such as the
Internet. IPSec includes data authentication, antireplay services and data confidentiality services.
Cisco follows these data encryption standards:
•IPSec—IPSec is an IP layer open standards framework that provides data confidentiality, data
integrity, and data authentication between participating peers. IKE handles negotiation of protocols
and algorithms based on local policy, and generates the encryption and authentication keys to be
used by IPSec. IPSec protects one or more data flows between a pair of hosts, between a pair of
security systems, or between a security system and a host.
•IKE—InternetKey Exchange (IKE) is a hybridsecurity protocol thatimplements Oakley and Skeme
key exchanges inside the Internet Security Association and Key Management Protocol (ISAKMP)
framework. IKE can be used with IPSec and other protocols. IKE authenticates the IPSec peers,
negotiates IPSec security associations, and establishes IPSec keys. IPSec can be configured with or
without IKE.