Cisco PIX - Change password

One of the first things you should do is change the default passwords for the PIX.

pixfw# conf t
pixfw(config)# enable password enable-password-here 

pixfw(config)# passwd telnet-password-here -

pixfw(config)# exit

pixfw#

Note: The console password is the one used to gain access from the console or through telnet.

Cisco PIX - Object group

SAMPLE

object-group service YM tcp-udp
description Yahoo Messenger
port-object range 8001 8002
port-object eq 5050
port-object eq 23
port-object eq 20
port-object eq 119
port-object eq 25



object-group service RemoteTCP tcp
port-object eq 5900
port-object eq 3389
port-object eq 5800

RTMP

object-group service RTMP tcp
description RTMP requested by Smartcard 03232010
port-object eq 1935
port-object eq 8088
port-object eq 843
port-object eq 5080


access-list outside line 62 extended permit tcp any host 219.93.13.x object-group RTMP
access-list outside line 63 extended permit tcp host 60.52.142.241 host 219.93.13.x eq 5900

refer : http://www.cisco.com/en/US/docs/security/pix/pix62/command/reference/mr.html#wp1095114

Cisco PIX - Top Ten Tips for Managing Your Firewall

This article discusses the Top ten tips that you can implement to best manage and fine tune your firewall. The purpose of this article is to get the best performance out of your firewall and increased security to your network.


1. Use the latest version of the OS software available for your particular firewall. Install the latest patches and if possible/applicable, the latest software version available.

2. Use a stealth Rule at the top of the rule base.
What is a stealth rule? A stealth rule is a rule which disallows any communication to the firewall itself from unauthorized networks/hosts. It is a rule to protect the firewall itself from attacks.

3. Place the most commonly used or accessed rules on the top of the rule base. When a packet reaches a firewall it gets checked against the rulebase of the firewall from top down. Once it matches a rule, it is either accepted, denied or acted upon depending on what the action defined is. So it is best to place the most accessed rules on top of the rule base so that it need not get matched against all the rules in rule base. This would decrease load on the firewall.

4. Keep the rulebase as simple as possible. Do not allow access to anything and everything. Give access only if it is needed or required.

5. Use object groups where possible and combine similar rules into one rule. This would keep the rule base short and simple and thus reduce the load on the firewall.

6. If your network is using VPN, then give preference to use AES 128 where ever possible. Some firewalls like the popular Checkpoint Firewall, recommend AES 128 over 3DES and AES 256, in terms of firewall load and performance issues. Check with your firewall manufacturer which encryption would provide best performance on the given make, taking into consideration that security is also one of your main priorities.

7. Keep logging to a minimum. Example: If you have a couple of busy web servers, then logging each and every http connection might bring in addition load onto the firewall and also fill up the log server quickly.

8. Try to implement High Availability if your budget would allow that. This would reduce the down time of your network considerably. If a firewall is down it would mean that pretty much most of your operations are down. If High Availability is implemented, then even if the primary were to fail, the secondary would take over. Firewall Clustering is something which can provide your firewall both redundancy and load sharing. Check with the manufacturer if it is available.

9. If there are too many VPN connections that need to connect to your network, then try to get a dedicated VPN device. How many connections are too many connections? Check the firewall manufacturer’s manual. Another way of doing it is checking the load on the firewall – memory, cpu utilization etc.

10. End your rule base with a clean up rule or a ANY ANY DENY rule. Try to also log this rule. This would assist you in analyzing the dropped connections in case you ever attacked or even while simple troubleshooting.

Note: The intention of this article is to help you manage your firewall. Check your Firewall manufacturer’s instruction manual to confirm if the tips given here would be applicable to the particular make/model.

FEEDBACK: Please feel free to leave your feedback good and bad. Best effort would be made to make this article as helpful as possible.

Referring from :
http://www.secmanager.com

Cisco PIX - Useful Commands

Useful Commands:

show config

show blocks

show checksum

show conn

show cpu usage

show history

show memory

show processes

show routing

show running-config

show startup-config

show tech-support

show tcpstat

show traffic

show uauth/clear uauth

show version

show xlate/clear xlate

Cisco PIX - Commands Supported in CLI

 

Command Mode	Command	Command Description
User Mode	enable	To change the mode from User to Enable mode.
	help	Displays the help description in the Modes.
	exit	To log out from the CLI client.
	logout	To log out from the CLI client.
	show clock	To show the clock time of the CLI agent in the network.
	show history	To display the History of the connected terminal.
	show snmp	To show the SNMP status of the device in the network.
	show version	To show the version of the device.
Enable Mode	clock set	Sets the Clock with Date and Time in the firewall device
	configure terminal	Change the mode to Configuration Mode
	disable	Change the mode to user mode from Enable mode.
	ping	Send echo messages
	show access-list	Displays the access-list configurations
	show blocks	To show the system buffer usage
	show conn	To show the number of connections in use
	show failover	To show the failover status
	show memory	To show the free memory available
	show nameif	To show the current names and security levels of each interface
	show clock	Display clock time of the CLI agent in the network.
	show history	Displays the History of the connected terminal.
	show version	Displays the IOS Version and its details of the CLI agent.
Config Mode	access-group in interface	Binds the access list to the inside interface.
	access-list host	Creates the standard access list entry
	access-list /	Creates the standard access list entry
	exit	Change the mode from Configuration to Enable mode.
	hostname	Updates the given value as the host name.
	snmp-server enable traps	Enables all the supported trap types
	snmp-server host [host-addr] [community-string]	To specify the recipients of the SNMP notification operatio
	route [metric]	Set the inside/outside default route to the router attached to the Internet.
	no number	To remove a specific access-list
	no snmp-server enable traps	Disables all the supported trap types
	no snmp-server host	Removes a specific recipient of the SNMP notification operation

Cisco PIX - Introduction 1

Intro..

1. Use to prevent our network wide open from attack
2. PIX firewall range has a wide variety of add on cards
3. can work hand in hand with the Adaptive Security Appliance (ASA)
4. PIX come in several form factors range:

a. 501

• cheapest and smallest firewall - SOHO
• support up to 7500 concurrent connections
• 60Mbps throughput
• interfaces- 10/100BASE-T Ethernet interface for the outside connection (100BASE-T is only in version 6.3)
• four-port 10/100 switch for the inside interfaces
• It can also support up to 10 simultaneous VPN connections
• It does not support any failover at all.