Table of Contents

Product Overview
Key Features and Benefits
Specifications

Cisco Secure PIX Firewall Software
PIX Firewall Manager Specifications

Ordering Information

Services and Support

Cisco Secure PIX Firewall Series

Product Overview

The Cisco Secure PIX Firewall series delivers strong security in an easy-to-install, integrated hardware/software appliance that offers outstanding performance. The series allows you to rigorously protect your internal network from the outside world—providing full firewall security protection. Unlike typical CPU-intensive full-time proxy servers that perform extensive processing on each data packet at the application level, Cisco Secure PIX Firewalls use a non-UNIX, secure, real-time, embedded system. The Cisco Secure PIX Firewalls deliver superior performance of up to 250,000 simultaneous connections, over 6,500 connections per second, and nearly 170 megabits per second (Mbps) throughput. This level of performance is dramatically greater than that delivered by other appliance-like firewalls or those based on general-purpose operating systems.

Figure 18-4: Cisco Secure PIX Firewall 520 Rear View

Figure 18-5: Cisco Secure PIX Firewall 515 Front View

Figure 18-6: Cisco Secure PIX Firewall 515 rear View

Key Features and Benefits

• Non-UNIX, secure, real-time, embedded system

  This design eliminates the risks associated with a general purpose operating system and allows the Cisco Secure PIX Firewall series to deliver outstanding performance—up to 250,000 simultaneous connections—dramatically greater than any UNIX-based firewall and without affecting end-user performance.

• Less complex and more robust than packet-filtering; higher performance and more scalable than application proxy firewalls

  The heart of the PIX Firewall series is the adaptive security algorithm (ASA), which maintains the secure perimeters between the networks controlled by the firewall. The stateful, connection-oriented ASA design creates session flows based on source and destination addresses, TCP sequence numbers (which are non-predictable), port numbers, and additional TCP flags. All inbound and outbound traffic is controlled by applying security policy to connection table entries.

• User authentication and authorization with cut-through proxy

  Cisco Secure PIX Firewall series gains further dramatic performance advantage through its patented method of transparently verifying the identity of users at the firewall and permitting or denying access to any TCP- or UDP-based application. This method eliminates the price/performance impact UNIX-based firewalls impose in similar configurations, and leverages the authentication and authorization services of CiscoSecure Access Control Server. For more information on CiscoSecure Access Control Server, available for both Windows NT and UNIX (Solaris), see the chapter "CiscoSecure Access Control Server Software."

• Centralized configuration and management with the PIX Firewall Manager

  This Java-based graphical user interface (GUI) configuration tool lets the administrator use a Web browser to retrieve, edit, and centrally manage security policies. Separate tabs provide access to configuration information common to all PIX Firewalls being managed and to built-in reports for user-based accounting for web sites visited and volume of files transferred. The PIX Firewall Manager can automatically provide real-time alerts of any attempted firewall breaches through e-mail or pager notification.

• Platform extensibility

  To provide platform extensibility without sacrificing the benefits of an embedded system, the PIX Firewall series includes two hardware platforms, the PIX Firewall 515 and 520, which support a broad range of network interface cards (NICs). Standard NICs include single- or four-port 10/100 Ethernet cards, 4/16 Token Ring cards, and dual-attached multimode FDDI cards. FDDI cards and four-port Ethernet cards are supported in PIX beginning with version 4.4.

• Failover/hot standby upgrade option

  The PIX Firewall failover option ensures high availability and eliminates a single point of failure. With two PIX Firewalls running in parallel, if one malfunctions, the second PIX Firewall transparently maintains security operations.

• Synchronized configurations for effective recovery from hardware failure

  Simplified TFTP boot function allows consistent synchronization of multiple device configurations.

Specifications

. Failover requires special, Cisco cable

Cisco Secure PIX Firewall Software

• PIX 520 - Connection licenses available for 128, 1024, and Unrestricted (more than 250,000) simultaneous connections

  PIX 515 - Only unrestricted licenses available

  PIX 520 - Ethernet, FDDI and Token Ring available

  PIX 515 - Restricted (no failover, 32 MB RAM, no option cards, 2 ethernet interfaces only)

  PIX 515 - Unrestricted (64 MB RAM, failover, up to 6 ethernet interfaces)

  PIX 515 - Ethernet only

• Adaptive security algorithm (ASA)

• Cut-through proxy authenticates, authorizes, and enhances performance

• Multiple interface support (10/100 Mbps ethernet, Token Ring, FDDI)

• Up to 6 ethernet interfaces

• Failover/hot standby; synchronized configurations

• True Network Address Translation (NAT) as specified in RFC 1631

• Port Address Translation (PAT) further expands a company`s address pool-one IP address supports more than 64,000 hosts

• Mail Guard removes need for external mail relay server in perimeter network

• TACACS+, Radius authentication

• DNS Guard transparently protects outbound name and address lookups

• Flood Guard and Fragmentation Guard protect against denial of service attacks

• Java blocking eliminates potentially dangerous Java applets (not compressed or archived)

• Extremely high-performance URL filtering that surpasses the competition in any enterprise-scale network

• Cisco IOS-style command-line interface

• Extended authentication, authorization, and accounting capabilities

• Net Aliasing transparently merges overlapping networks with the same IP address space

• Enhanced granularity of inbound access (conduits)

• Allows use of existing registered IP addresses

• Extended access lists

• Ability to customize protocol ports

• Support for private networking of virtual sites at greater than 45 MB using Cisco proprietary Private Link 2.

• Enhanced customization of syslog messages

• Simple Network Management Protocol (SNMP) and syslog for remote management

• Reliable syslogging using either TCP or UDP

• Extended transparent application support (both with and without NAT enabled) includes:

  • Sun remote procedure call (RPC)

  • Microsoft Networking client and server communication (NetBIOS over IP) using NAT

  • Multimedia, including Progressive Networks` RealAudio, Xing Technologies` Streamworks, White Pines` CuSeeMe, Vocal Tec`s Internet Phone, VDOnet`s VDOLive, Microsoft`s NetShow, VXtreme Web Theatre 2; and Intel`s Internet Video Phone and Microsoft`s NetMeeting (based on H.323 standards)

  • Oracle SQL*Net client and server communication

PIX Firewall Manager Specifications

• Hosted on a Windows NT 4.0 platform (required) Service Pack 4 compliant

• Each PIX Firewall Manager supports up to 10 PIX Firewalls for full logging, and configuration for up to 10 PIX Firewalls

• E-mail and pager alarms can be set based on single events or after a threshold is reached

• Built-in reports to display FTP and URL activity per user on a daily basis

• All configuration information sent between PIX Firewalls and PIX Firewall Manager are protected by a shared secret/secure hash algorithm (MD5)

• Strong authentication (one-time password) support for PIX Firewall management sessions can be provided by CiscoSecure or other TACACS+ or RADIUS server

For additional specifications, see the Cisco Secure PIX Firewall datasheet on the Cisco Web at www.cisco.com. For software options for the Cisco Secure PIX Firewall Series, see PIX Firewall Software in the following table.

Ordering Information

Services and Support

Posted: Wed Sep 27 05:14:22 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.