Installing ASDM on a Cisco PIX Firewall

After going command line for the past year on our upgraded PIX 515e, I decided to install the GUI control module known as the ASDM (Adaptive Security Device Manager). I was expecting it to be more of a involved install but the short story is:

1.     Download ASDM

2.     Copy to PIX flash

3.     Point PIX to image

I’ll run you through the long version now.

Let’s start out by going to Cisco and downloading the ASDM image for your respective PIX model and IOS version.

http://www.cisco.com/en/US/products/ps6121/index.html

You’ll need a CCO account to login and download the software.  Just make sure you find the right version. I’m running a PIX 515e with 7.2(2) so I downloaded ASDM 5.24.  I also downloaded the client end software which you can install on your PC to remotely control the configuration of the PIX without ever having to connect (great!). You can skip this and download later.  If you login into the web interface of your PIX after completion it will prompt you to download if you so desire.

Okay so you’ve downloaded the ASDM image let’s get it installed:

Login to the PIX – go to enable mode

Copy the ASDM image to the PIX via tftp (you’ll need a tftp server if you don’t have one installed already – go download the free one at solarwinds.com)

PIX# copy tftp: flash

"Address or name of remote host?” Put in the IP Address of your tftp server and hit .

"Source filename?" Enter the filename of the ASDM image.  Mine was asdm524.bin.

"Destination file name?" Just hit enter to leave the same filename on the PIX flash.

After copying for a few minutes it was done.  Now we just need to change some lines in the running PIX config to tell it where the new image is.

Goto configuration mode:

PIX# conf t

Then type the location of the ASDM:

PIX (config) # asdm image flash:/asdm-524.bin

If your version is different you’ll have to adjust the above line .bin file.

Now let’s enable the web interface on the PIX:

PIX (config) # http server enable

Last part is to allow connections from the inside interface of your firewall.

PIX (config) # http 0 0 inside

Of course this can be adjusted with your security policy and only allow it from certain networks or hosts.

That’s it.  Access the GUI by pointing your browser to:

https://ip.address.your.pix/admin

If it works make sure you don’t forget to save your running config (write mem).

Enjoy!

Getting rid of these damn fake virus protectors

Over the past few months I've seen a dozen computer infected with these ransomware programs.  Not sure how everyone is getting it.... clicking on the wrong link probably the main reason my guess.  The fact is these things SUCK - they've been a pain to get rid of.  Just wanted to pass along my single source of removing almost everything.

I've used it on the following BAD programs:

InfoStealer

XP AntiVirus 2008

XP AntiVirus 2009

Malwarebytes can be downloaded at:

http://www.malwarebytes.org

This has become the best tool in my collection of malware killers.  It hasn't failed me yet.

Install - update - run full scan - that's pretty much it.

It's free but feel free to buy their purchase versions.

The best testimonial I've heard about this is from MajorGeeks.com

"Using Malwarebytes' Anti-Malware is like bringing an M4 to a knife fight."

So how do I get really good with Cisco routers?

This always seem to be the biggest quandry. How do you get to be good at routers if no one will let you touch them? Sure you could go on ebay and start paypal'ing your way to a wonderful Cisco lab in your garage but there has to be a better way right?

Now there is. When I first took the CCNA 8 years ago I was limited to the Sybex CCNA training simulator. Sure it was better than nothing but it was very limited. Good enough to past the test but not good enough to become proficient at routers.

Now enter Dynamips. It's an emulator that is able to boot real Cisco IOS files thus allowing users to run REAL routers within windows of their desktop. Real routers. Real commands. Everything is there.

I recently took an advanced Cisco class and the training was performed with Dynamips. Each student was able to fire up a series of routers to perform the labs. Short of stacking up a bunch of routers on my desk I've never been able to perform the tasks that we did. In my spare time I was able to pretty much duplicate our North America network we have at work. Same IP addresses and configurations and everything. EIGRP running and everyone was talking.

Now for the fun part I was able to manipulate those configurations to see how things were affected. I can't do this on our production network. I was able to turn on debugging at all levels.

1000 foot overview of Dynamips:

• Free
• Linux or Windows
• Need to have access to Cisco IOS's
• Can be frustrating to get installed and working

I plan on posting a multipart series on how to install and get everything working from start to finish - to include Dyangen and GNS3 which can provide a beautiful GUI interface to everything you want to with Dynamips.

In the meantime I leave you these links:

Dynamips

http://www.ipflow.utc.fr/index.php/Cisco_7200_Simulator

Dynagen

http://dynagen.org/

GNS3

http://www.gns3.net/

NEDI and me - Cisco management on the cheap!

Anyone else using NEDI? If you don't use it and you're in a Cisco environment like I am you might be interested in using it.

High Level Overview:

• Configuration managment (grabs the configs on all our devices for backup) and shows diffs!
• Uses SNMP, CDP and telnet credentials to pull just about everything about your network
• Great for network inventory - tracks serial numbers etc.
• Performs node listing down to the port - uses ARP to figure out who's where - easy to find anyone and what switch/port they are in

Like I said this is the 1000 foot overview - I recommend you try it yourself .... and it's FREE

Have it running on a VM with Ubuntu 6 server (no X)

If you're like me you want screenshots ... so here you go

http://www.nedi.ch/doku.php?id=gallery:gallery

Putty Reborn

Just like all good admins I rely on SSH connections to a lot of my stuff.... and I hate putty.
Okay okay get off my back... I just don't like it. It's too clumsy. Sure it works but just not as well as I want it to.

That's until I was introduced to the Putty Connection Manager

http://puttycm.free.fr/

Best tool I've come across in a while - definitely recommend

The tabbed connectinons, moveable/dockable windows, automatic login .... what more can a guy ask for?