cc/td/doc/product/iaabu/pix
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

Release Notes for the
PIX Firewall Manager Version 4.3

Release Notes for the
PIX Firewall Manager Version 4.3

January 1999

This document describes how to install and configure Cisco's PIX Firewall Manager.

The following topics are covered in these release notes:

Important Notes

    1. Each PIX Firewall you wish to manage must be running PIX Firewall version 4.3(2) or later.

    2. Each PIX Firewall you manage must have previously been configured with the PIX Firewall telnet command or PIX Firewall Setup Wizard to permit access to the PIX Firewall from the PIX Firewall Manager's Management Server. Refer to "PIX Firewall Requirements" for other requirements.

    3. The Windows NT workstation or server on which you install PIX Firewall Manager must be running version 4.0 or later with Service Pack 3. Refer to "Management Server Requirements" for other requirements.

    4. A PIX Firewall Syslog Server (PFSS) is available for logging PIX Firewall event information on a Windows NT system. PFSS provides logging features not available with the PIX Firewall Manager (PFM), such as using TCP for highly reliable message delivery and control. PFM has features not available with PFSS, such as generating reports from syslog information.

The PIX Firewall does not support running both the PFM and PFSS applications at the same time. You must use either PFM or PFSS, but not both. For more information on installing and running PFSS, refer to the Quick Installation Guide for the PIX Firewall Version 4.3.

    5. The Windows NT computer running the PIX Firewall Manager Management Client (graphical user interface) must have a network browser that is Java 1.02 compliant. Refer to "Management Client Requirements" for more information.

    6. Selecting a menu item (or screen) is indicated by the following convention:
    Select screen1>screen2>screen3.

    7. The initial PIX Firewall Manager password is set to expire after 42 days. Refer to "Changing Passwords" for more information.

Introduction

Cisco's PIX Firewall Manager (PFM) lets you administer one or more PIX Firewall units, view syslog messages, and define customized alarms for each type of syslog message. You can use the PIX Firewall Manager to view, add, and modify the configuration of each PIX Firewall unit.

PIX Firewall Manager software includes these components:

PIX Firewall Manager provides two access levels: user-level with read-only (non-modifying) access and administrator-level with read and write access.

Diskettes for installing PIX Firewall Manager are provided in the PIX Firewall accessory kit.

If you are upgrading from a previous version of PIX Firewall Manager software, refer to the Configuration Guide for the PIX Firewall Version 4.3, which is included with your PIX Firewall accessory kit. This document has instructions for downloading software from Cisco Systems, Inc.

PIX Firewall Manager can be installed and uninstalled on Workstation and Server versions of Windows NT 4.0.

Features

The PIX Firewall Manager provides you with the following features:

Note The Tasks button generates statements in the PIX Firewall configuration that allow connections to or from hosts on internal (protected) networks. If you have additional configuration requirements, such as access control for outbound connections and user authentication or authorization, other configuration commands apply. Refer to the Configuration Guide for the PIX Firewall Version 4.3 for detailed configuration information.

Refer to the Configuration Guide for the PIX Firewall Version 4.3 for detailed information about PIX Firewall system features.

Usage Notes

    You are not authorized to run this installer.
Terminating...
 

    Could not find the domain controller for the domain.
In this case, the installation procedure cannot add the PIX Firewall Manager users and groups to the Windows NT Security Account Manager database, and attempts to use the PIX Firewall Manager will fail.
Note The established command in the command line interface is same as the Multimedia feature in the Management Client. To use this feature, select Administrator>Administration>Multimedia.
Interface entries can be specified as either IP addresses or domain names; however, you must remember to log on to the management server using the exact entry listed in the FIREWALL.HTML file or an IP address security violation error message can appear. This message indicates the Management Server could not locate the interface specified in the FIREWALL.HTML file, having tried the possible interfaces on the Windows NT computer running the Management  Server.

PIX Firewall Manager Installation

The sections that follow describe how to install PIX Firewall Manager.

The following topics are described in this section:

Information Requirements

Before installing PIX Firewall Manager, you need to know the following:

To view the IP address:

Step 1 Select Start>Settings>Control Panel.

Step 2 Double-click the Network icon.

Step 3 Click the Protocols tab and select TCP/IP Protocols>Properties.

Step 4 When the Microsoft TCP/IP Properties dialog box opens, click the IP Address tab. The IP address appears on the lower part of this tab.

Step 5 If the Obtain an IP address from a DHCP server item is checked, click it to disable it. Then click Specify an IP address and enter an IP address, subnet mask, and default gateway IP address for this system.

Software Requirements

The following sections list software requirements for using PIX Firewall Manager.

PIX Firewall Requirements

Note Each PIX Firewall you manage must have been configured with the PIX Firewall telnet command or PIX Firewall Setup Wizard to permit the Management Server to access the PIX Firewall.

All PIX Firewall units managed by PIX Firewall Manager version 4.3(2) must be running PIX Firewall software version 4.3(2) or later. To check the version of the PIX Firewall software, go to the PIX console and enter the show version command.

If you intend to manage PIX Firewall units on the outside network, each foreign unit must run Private Link and at least one firewall on the local network must also run Private Link. The local PIX Firewall must be configured to communicate with the foreign Private Link firewalls.

You must have console access to each local and foreign PIX Firewall you manage in order to perform the configuration required to run the PIX Firewall Manager. If you are managing remote firewalls, work with the site administrator to get the PIX Firewall to communicate with PIX Firewall Manager.

To configure each PIX Firewall unit from the Setup Wizard, follow the instructions in Appendix  C of the Configuration Guide for the PIX Firewall Version 4.3.

If you use the Setup Wizard, skip to "Windows NT System Requirements" and continue.

To configure each PIX Firewall unit from the command line, enter these commands at the PIX Firewall console:

Step 1 enable---to enter privileged mode. When prompted, enter the privileged mode password. The default is no password and you can press the Enter key at the prompt.

Step 2 configure terminal---to enter configuration mode.

Step 3 nameif---to specify the name or security level of the outside or optional third interface on the PIX Firewall. The inside interface cannot be renamed or given a different security level. Each security level must be a unique number between 0 and 99.

Step 4 interface---to set options for the Ethernet or Token Ring network interfaces.

Step 5 ip address---to assign IP addresses and network masks to each interface.

Step 6 telnet---to let the PIX Firewall communicate with the PIX Firewall Manager:

    : Telnet for PIX Firewall Manager 
telnet Windows_NT_IP_Address 255.255.255.255

Replace Windows_NT_IP_Address with the IP address of the Windows NT system.

Add the comment before the telnet statement to ensure that the next person configuring the firewall knows the purpose of this telnet statement.

Step 7 link and linkpath---if you are managing remote PIX Firewall units, configure each for Private Link access. Refer to Chapter 2, "Configuring the PIX Firewall," in the Configuration Guide for the PIX Firewall Version 4.3 for information on configuring Private Link, and Chapter 5, "Command Reference," to view the link command page for more information.

Step 8 write memory---save the configuration in Flash memory.

All commands are described in the Configuration Guide for the PIX Firewall Version 4.3 supplied in your PIX Firewall accessory kit.

Windows NT System Requirements

The Windows NT system on which you install the Management Server requires the following:

Management Server Requirements

The Management Server has the following requirements:

To use another .AU format sound file:

Step 1 Place the sound file on the Windows NT system running the Management Server in the JClient\Netscape subdirectory of the Management Server's target directory.

Step 2 Click the Management Client's Setting tab to modify the audio filename.

Management Client Requirements

The Management Client has the following requirements:

The system running the browser must use Windows 95, Windows NT 4.0 Workstation, Windows NT 4.0 Server, or Solaris. On Windows 95 or Windows NT 4.0, 32 MB RAM is highly recommended.

Installing PIX Firewall Manager

Note Only users with Windows NT Administrator privileges can run the installer or uninstaller program.

During installation, if a previous version of the PIX Firewall Manager is found, the installation program replaces the old version with the new. To install PIX Firewall Manager:

Step 1 If you used the PIX Firewall Setup Wizard to configure the PIX Firewall with the IP address and network mask of the Windows NT computer running the PIX Firewall Manager, skip to Step 2. If you have not set up the IP address for the Windows NT computer, verify network connectivity before starting by following these steps:

    enable
Password: (press Enter)
ping inside 192.168.42.42
 

    ping 192.168.42.54
 

    enable
Password: (press Enter)
configure terminal
: Created for PIX Firewall Manager
telnet 192.168.42.54
write memory

Step 2 Exit all Windows programs.

Step 3 Log in to the Windows NT system as Administrator or as any user who is a member of the Administrator group or who has Windows NT Administrator privileges.

Step 4 From the Windows NT system, insert the first PIX Firewall Manager diskette in the diskette drive. You can install the software:

Step 5 Once the installation program starts, you are prompted with a series of dialog boxes. You can simply click Next and the installation will proceed without interruption. Alternately, you can designate an installation directory other than the default.

Step 6 During the installation you are prompted for a port number for the PIX Firewall Manager's built-in web server; use the default, 8080, unless that port is in use already. Any port between 1025 and 64000 can be entered as an alternative. To pick another port, view ftp://ftp.isi.edu/in-notes/iana/assignments/port-numbers to find the ports in use.

The installation program then copies its files and prompts you to insert the second diskette. Insert the diskette and the remaining files are copied.

Step 7 At the last dialog box, click Finish. The Management Server starts automatically.

Step 8 To check whether the Management Server is running, select Start>Settings>Control Panel and double-click the Services icon. Look for the "PIX Firewall Management Server" service name. A server is running if its status appears as Started. If the status field is blank, you may run the server by selecting its name and then clicking Start. If you need to stop the Management Server, refer to the instructions for doing so in "Management Server Requirements."

Step 9 After the software setup completes, change the default passwords of the pixadmin and pixuser users with the Windows NT User Manager program described in the following section, "Changing Passwords."

Changing Passwords

To change passwords for the pixadmin and pixuser default usernames:

Step 1 Select Start>Programs>Administrative Tools (Common)>User Manager. If your Windows NT system is a domain controller, select User Manager for Domains.

Step 2 When the User Manager starts, locate the two users, pixadmin and pixuser in the Username section of the screen.

Step 3 Select the pixadmin username and select User>Properties.

Step 4 In the User Properties dialog box, enter the new password in the Password and Confirm Password fields.

Step 5 In the User Properties dialog box, check Password Never Expires to prevent the password from expiring. If the box is not checked, the password expires after the number of days set in the Account Policy Maximum Password Age configured in the Windows  NT system. The default value set during Windows  NT system installation is 42  days. Click OK to exit.

Step 6 Select the pixuser username and select User>Properties. Enter the new password in the Password and Confirm Password fields.

Step 7 In the User Properties dialog box, check Password Never Expires to prevent the password from expiring.

Step 8 Click OK to exit and select User>Exit to leave the User Manager.

Limiting Access to the Management Client

You can specify which users can access the Management Client by creating user accounts on the Windows NT system on which PIX Firewall Manager is installed and giving the user either PIX Firewall Manager administrative or read-only access privileges. When the Management Client starts, users enter their login ID and password and, if accepted, they can then run PIX Firewall Manager.

Note Before limiting access to the Management Client, change the default password to a new value as described in the preceding section, "Changing Passwords."

To limit access to the Management Client:

Step 1 Start the User Manager as described in Step 1 in the preceding section, "Changing Passwords." The User Manager dialog box appears. If you want to authorize access for users who already have accounts on the Windows NT system, proceed to Step 2. To add new users to the Windows NT system, select User>New User. Specify the information for the user including the user's login name, full name, and password.

Step 2 To give a user access to the Management Client, locate the Groups area at the bottom of the User Manager dialog box.

Step 3 From the Groups area, if you want users to be able to change PIX Firewall settings, double-click PIX Admins. If you want users only to have read access and no change privileges, double-click PIX Users. The Local Group Properties dialog box then appears.

Step 4 Click Add to add an existing user to the selected group. The Add Users and Groups dialog box appears.

Step 5 From the Names field, select the name of the user you wish to add, click Add, and then click OK to complete adding this user. Control returns to the Local Group Properties dialog box where you can continue adding users. To exit back to the User Manager dialog box, click OK. Then exit User Manager by clicking OK.

Note Do not assign a user to both the PIX Admins and PIX Users groups.

Starting the Management Client

To start the Management Client, restart the network browser, disable proxies, and then access the Management Client:

Windows 95, Windows NT, Solaris Netscape Navigator Version 3.x

Step 1 Choose the Network Preferences option from the Options menu.

Step 2 Click the Proxies tab, check the No Proxies option, and click OK.

Step 3 Choose the Open Location option from the File menu, enter ^L, or click Open, and enter the following:

    http://IP_address:port

where IP_address is the system running PIX Firewall Manager Server, and port is the Management Server's web server port that you defined in Step 6 of "Installing PIX Firewall Manager."

Windows 95, Windows NT, Solaris Netscape Communicator 4.0, 4.01, 4.02, 4.04, 4.05, Netscape Navigator 4.0, 4.01, 4.02, 4.04, 4.05

Step 1 Choose the Preferences... item from the Edit menu. A dialog box appears.

Step 2 In the hierarchy display at the left, double-click the Advanced item. (In Solaris, click the arrow beside Advanced.) The hierarchy expands to display additional choices.

Step 3 Click the Proxies item from the expanded hierarchy list.

Step 4 Check the Direct connection to the Internet option, and click OK.

Step 5 Choose the Open Location option from the File menu, enter ^L, or click Open, and enter the following:

    http://IP_address:port

where IP_address is the system running PIX Firewall Manager Server, and port is the Management Server's web server port that you defined in Step 6 of "Installing PIX Firewall Manager."

Windows 95 or Windows NT Microsoft Internet Explorer 4.0 Version 4.72.3110.8; Updated Version: SP1

Step 1 Choose the Internet Options... item from the View menu.

Step 2 Click the Connections tab.

Step 3 In the Proxies Server group box, disable the Access the Internet using a proxy server option.

Step 4 Return to the main menu and enter the following:

    http://IP_address:port

where IP_address is the system running PIX Firewall Manager Server, and port is the Management Server's web server port that you defined in Step 6 of "Installing PIX Firewall Manager."

Using the Management Client

You can view the Management Client applet with any network browser described in "Management Client Requirements."

Step 1 After you have disabled browser proxies as described in "Starting the Management Client" and started the Management Client, the home page appears.

Step 2 You can generate reports using Microsoft Excel 97 by following the instructions on the home page.

Step 3 Select Run Management Client.

Step 4 After the Management Client is loaded, you are then prompted for a username and password. For the username, enter pixadmin for read-write access, or pixuser for read-only access. Enter either the default password, cisco, or the new password entered in Step 9 of "Installing PIX Firewall Manager."

You can also use any username that is in either the PIX Admins or PIX Users group. When you complete entering a username and password, click OK. The Management Client then opens after it loads into memory.

Note When the program is loading, do not minimize the web browser.

Step 5 If you need to restart the applet, you can click the browser's Reload button.

Navigating the Management Client

After you enter your login credentials, the Management Client window appears.

Step 1 To view or modify the PIX Firewall configuration, go to the Main Tree window on the left side of the Management Client window and double-click a PIX Firewall folder. If the Main Tree window is empty, click Add A PIX Firewall in the Contents window to add PIX Firewall units to the Main Tree. Click the Reload Configuration button in the Contents window to get the most current configuration.

Note Any change to the configuration of a PIX Firewall made in the Management Client is sent immediately to the firewall and automatically saved in the firewall's RAM.
Note If you have made changes to the configuration as described in the Configuration Guide for the PIX Firewall Version 4.3, click the Reload Configuration button following the upgrade to get the current configuration information.

The areas of the Management Client window are as follows:

Step 2 Double-click the configuration option you want from the folder in the Main Tree. The folder then opens into a series of subfolders or files for each configuration feature. The Contents area displays information about each configuration feature. Use the button selections to get help information, view current configuration information, or change configuration settings.

Step 3 To ensure that the firewall can reload the new configuration after reboot, save the configuration in the firewall's Flash memory by clicking the Save to Flash Mem of PIX button. To back up the configuration to a diskette, follow these steps:

Stopping the Management Client

To stop the Management Client, stop the network browser on which it runs.

Stopping the Management Server

If you need to stop the Management Server:

Step 1 Select Start>Settings>Control Panel>Services.

Step 2 When the Services dialog box opens, select the PIX Firewall Management Server item from the Service list. You can stop this service by clicking the Stop button.

Generating and Printing Syslog Reports

The PIX Firewall generates syslog messages for system events, such as security alerts and resource depletion. Syslog messages are stored in log files and can be used to create alerts and reports.

The PIX Firewall Manager provides two ways to view syslog connection information: using the PIX Firewall Management Client graphical user interface, or using a Microsoft Excel macro and data files provided for Microsoft Excel  97. Options for printing reports are available only using Microsoft Excel  97. This section includes the following topics:

Configuration Requirements

Prior to using the Alarm and Report features, you must configure each PIX Firewall to generate syslog messages and send them to a syslog server host, one of which can be the host running the PIX Firewall Manager. The syslog server in the PIX Firewall Manager listens for messages from the PIX Firewall on UDP port 514. Messages are stored in daily log files on the Windows NT computer running the PIX Firewall Manager. The PFM uses the information in the daily log files to generate reports. To configure each PIX Firewall unit from the Management Client, select Admininstrator>SYSLOG to view options for configuring syslog host and message information.

Viewing Reports

To view syslog reports from the PIX Firewall Management Client, follow the instructions for "Navigating the Management Client." From the Management Client, click the Alarm and Report tab to view options for generating reports. 

    Cannot open the corresponding DBF file
Note When downloading the files from the web browser, be sure to save all files (report.xls, dns.dbf, monday.dbf, sunday.dbf, and so on) to the same directory on the local drive. After all the files are in the same directory, use Microsoft Excel 97 to open the report.xls file.
Note The macro does not support viewing or printing detailed reports of FTP and HTTP file transfers as provided in reports generated by the PIX Firewall Management Client.

The PIX Firewall Manager saves syslog information in daily log files. For example, PIX Firewall connection information for Monday is saved in the monday.log file. The log files are located in \PIX Firewall Manager\protect\<weekday>.log on the Windows NT computer.

Log files are retained for one week, allowing a separate log file for each day of the week. After one week, daily log files are overwritten, starting with the daily file that was created first. For example, if log files were first started on Monday, the Monday log file will be overwritten in seven days. This also means that you can access a six-day archive of log information for a given day.

Note For reporting purposes, hosts on a perimeter network are considered "outside." When setting up syslog reports from the PIX Firewall Management Client, you must specify "outside" to include the hosts on the perimeter network in the report.

Troubleshooting Syslog Reporting Problems

Problems generating syslog reports can mean that one or both of the configuration settings for the syslog host or Message type is not correct, or that data is not reaching the syslog host. If you have problems displaying syslog report information, or you receive a "Database Empty" error message, check the following items:

Note Close the SYSLOG Message Window after you have verified that information is being received at the syslog host. These messages can fill up system memory on the host, slowing performance.
Note The Facility setting in the Edit SYSLOG Output dialog box is not used by the PIX Firewall Manager Management Client for generating reports. The report wizard provided with the Management Client references hosts by IP address.

Troubleshooting the PIX Firewall Manager

If you have problems installing or using the PIX Firewall Manager, check the following items:

A version of the PIX Firewall SYSLOG SERVER is detected on this machine. You must uninstall PIX Firewall SYSLOG SERVER before installing the PIX Firewall Manager.
If the PIX Firewall Manager installation detects the presence of the PIX Firewall Syslog Server application on the same system, it displays a message warning you that both applications exist. The PIX Firewall does not support running both the PFM and PFSS applications at the same time. You must use either PFM or PFSS, but not both. For more information on installing PFSS, refer to the Quick Installation Guide for the PIX Firewall Version 4.3.
Verify that the PIX Firewall has been configured for Telnet access from the Windows NT computer where the PIX Firewall Manager Server is installed.
Verify that the user is a member of the PIX Admins or PIX Users groups on the Windows NT computer. If the user is not a member of a group, add the user.
This can indicate that the client portion of the application is not communicating with the server portion. To determine where errors might be occurring, use the following procedure to launch the PIX Firewall Manager to the desktop:

Step 1 Select Start>Settings>Control Panel>Services on the Windows NT computer.

Step 2 Scroll through the services to locate the PIX Firewall Manager Server.

Step 3 Double-click PIX Firewall Manager Server, which displays the Service dialog box.

Step 4 In the Service dialog box, check Allow Service to Interact with Desktop and click OK.

Step 5 In the Services dialog box, click Stop to halt the PIX Firewall Manager Server; then click Start to restart the service.

Step 6 Start the PIX Firewall Manager. Errors generated by the application appear in the PIX Management dialog box.

Copy the errors messages in the dialog boxes and use Cisco Connection Online (CCO) for additional support.

If the Management Client appears to stop working and reports Java applet errors, use the following procedure to launch the Java console from the web browser.
The error messages appear in the Java console panel. If the error messages report security violations, it can mean that the Management Client is having trouble communicating with the Management Server. In such cases, try the following:
Do not use File>Open from the browser menu to access the Management Client.


If the problems persist, use Cisco Connection Online (CCO) for additional support.




 Cisco Connection Online

 
 Cisco Connection Online (CCO) is Cisco Systems' primary, real-time support channel. Maintenance customers and partners can self-register on CCO to obtain additional information and services.


 Available 24 hours a day, 7 days a week, CCO provides a wealth of standard and value-added services to Cisco's customers and business partners. CCO services include product information, product documentation, software updates, release notes, technical tips, the Bug Navigator, configuration notes, brochures, descriptions of service offerings, and download access to public and authorized files.


 CCO serves a wide variety of users through two interfaces that are updated and enhanced simultaneously: a character-based version and a multimedia version that resides on the World Wide Web (WWW). The character-based CCO supports Zmodem, Kermit, Xmodem, FTP, and Internet e-mail, and it is excellent for quick access to information over lower bandwidths. The WWW version of CCO provides richly formatted documents with photographs, figures, graphics, and video, as well as hyperlinks to related information.


 You can access CCO in the following ways:



 For a copy of CCO's Frequently Asked Questions (FAQ), contact cco-help@cisco.com. For additional information, contact cco-team@cisco.com.



Note If you are a network administrator and need personal technical assistance with a Cisco product that is under warranty or covered by a maintenance contract, contact Cisco's Technical Assistance Center (TAC) at 800  553-2447, 408  526-7209, or tac@cisco.com. To obtain general information about Cisco Systems, Cisco products, or upgrades, contact 800  553-6387, 408  526-7208, or cs-rep@cisco.com.



 Documentation CD-ROM

 
 Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM, a member of the Cisco Connection Family, is updated monthly. Therefore, it might be more current than printed documentation. To order additional copies of the Documentation CD-ROM, contact your local sales representative or call customer service. The CD-ROM package is available as a single package or as an annual subscription. You can also access Cisco documentation on the World Wide Web at http://www.cisco.com,  http://www-china.cisco.com,  or http://www-europe.cisco.com.
  

 If you are reading Cisco product documentation on the World Wide Web, you can submit comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco. We appreciate your comments.


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


  






hometocprevnextglossaryfeedbacksearchhelp


Posted: Mon Feb  8 01:19:12 PST 1999

Copyright 1989-1999©Cisco Systems Inc.