Re: PIX 501 Switch Problem

andyleealbrecht · ‎10-31-2005

My PIX 501 has been running like a champ for the last 6 months but today when I came home, all of the lights on the switch portion were off. The power light and the light for the 0 port were still lit up but none of the lights for the 1-4 ports were lit up. I haven't made any configuration changes, so I'm not sure why all of a sudden the switch portion would just up and quit. I've powered it off and that didn't make a difference. Any help or ideas would be appreciated. I'd be glad to provide any information needed. Thank you.

jdepies · ‎10-31-2005

if you plug in the console cable will it reboots, do any errors come up on the screen?

andyleealbrecht · ‎10-31-2005

Thanks for the response! I tried setting it back to factory defaults a few minutes ago and when it boots up it now says "Cannot select private key" but it didn't say that before. Other than that, I don't see any errors on boot.

jdepies · ‎11-01-2005

can you copy and paste the entire boot text from the console screen? That way we can see how far in the boot process it gets before it errors out.

Patrick Iseli · ‎11-01-2005

The error message for the private is normal when the hostname or domainname does not fit with the ssh private key. You can simply create a new one and the message will disappear.

#To see the ss key:

show ca mypubkey rsa

#configure hostnmae and domainname:

hostname cisco-pix

domain-name example.com

#Remove old public key:

ca zeroize rsa key

#Generate a new ssh key:

ca generate rsa key 1024

#Verifiy again the ssh key:

show ca mypubkey rsa

Save the new ssh key:

ca save all

Allow incomming ssh connections:

ssh ip_address [netmask] [interface_name]

See whitepaper for this settings:

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172797.html#wp1034079

sincerely

Patrick

andyleealbrecht · ‎11-01-2005

I followed the instructions provided by patrick.iseli and I was able to get rid of that private key error.(Thanks patrick) Here is what I captured during boot...Hopefully there is a way to resolve my switch problem. Thanks again!

*****************************************

Rebooting....

CISCO SYSTEMS PIX-501

Embedded BIOS Version 4.3.200 07/31/01 15:58:22.08

Compiled by morlee

16 MB RAM

PCI Device Table.

Bus Dev Func VendID DevID Class Irq

00 00 00 1022 3000 Host Bridge

00 11 00 8086 1209 Ethernet 9

00 12 00 8086 1209 Ethernet 10

Cisco Secure PIX Firewall BIOS (4.2) #6: Mon Aug 27 15:09:54 PDT 2001

Platform PIX-501

Flash=E28F640J3 @ 0x3000000

Use BREAK or ESC to interrupt flash boot.Use SPACE to begin flash boot immediately.Flash boot in 10

seconds. 9 seconds. 8 seconds. 7 seconds.6 seconds.5 seconds. 4 seconds. 3 seconds. 2 seconds. 1 seconds.

Reading 1962496 bytes of image from

flash.################################################################################################

###############

16MB RAM

mcwa i82559 Ethernet at irq 9 MAC: 0013.c365.defb

mcwa i82559 Ethernet at irq 10 MAC: 0013.c365.defd

Flash=E28F640J3 @ 0x3000000

BIOS Flash=E28F640J3 @ 0xD8000

-----------------------------------------------------------------------

|| ||

|||| ||||

..:||||||:..:||||||:..

c i s c o S y s t e m s

Private Internet eXchange

-----------------------------------------------------------------------

Cisco PIX Firewall

Cisco PIX Firewall Version 6.3(4)

Licensed Features:

Failover: Disabled

VPN-DES: Enabled

VPN-3DES-AES: Enabled

Maximum Physical Interfaces: 2

Maximum Interfaces: 2

Cut-through Proxy: Enabled

Guards: Enabled

URL-filtering: Enabled

Inside Hosts: 10

Throughput: Unlimited

IKE peers: 10

This PIX has a Restricted (R) license.

****************************** Warning *******************************

Compliance with U.S. Export Laws and Regulations - Encryption.

This product performs encryption and is regulated for export

by the U.S. Government.

This product is not authorized for use by persons located

outside the United States and Canada that do not have prior

approval from Cisco Systems, Inc. or the U.S. Government.

This product may not be exported outside the U.S. and Canada

either by physical or electronic means without PRIOR approval

of Cisco Systems, Inc. or the U.S. Government.

Persons outside the U.S. and Canada may not re-export, resell

or transfer this product by either physical or electronic means

without prior approval of Cisco Systems, Inc. or the U.S.

Government.

******************************* Warning *******************************

Restricted Rights Legend

Use, duplication, or disclosure by the Government is

subject to restrictions as set forth in subparagraph

(c) of the Commercial Computer Software - Restricted

Rights clause at FAR sec. 52.227-19 and subparagraph

(c) (1) (ii) of the Rights in Technical Data and Computer

Software clause at DFARS sec. 252.227-7013.

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, California 95134-1706

Cryptochecksum(unchanged): 4d7d25f4 e03f1452 ca1c82da 531641b5

Type help or '?' for a list of available commands.

pix>

Patrick Iseli · ‎11-01-2005

I removed the doublicated message :-(

Patrick Iseli · ‎11-01-2005

Just to do a recapulation of the status of your problem. Now everthing is working or do you still have an issue with your Switch ports ?

Note: That the power plug is not very reliable. You just move the power cable a little bit and the PIX 501 stops functioning correctly. I have seen this on some PIX 501 devices.

sincerely

Patrick

andyleealbrecht · ‎11-02-2005

I'm still having problems with the switch ports. The PIX is getting power and the power light is lit. I can also use the console port and Port 0 will also work and light up, but none of the ports 1-4 appear to be working at all. Any help would be appreciated.

andyleealbrecht · ‎11-02-2005

I'm assuming that without any good ports on the switch portion that this PIX 501 is now pretty much useless. Is this a correct assumption?

Patrick Iseli · ‎11-02-2005

This sounds like a hardware issue, do you still have a garantie ?

This guides might help you to figure out the problem:

PIX Hardware Troubleshooting:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094fd9.shtml

Hardware Troubleshooting Index Page:

http://www.cisco.com/en/US/products/hw/routers/ps214/products_tech_note09186a008012fb88.shtml

All PIX papers:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/tsd_products_support_series_home.html

sincerely

Patrick

andyleealbrecht · ‎11-02-2005

Unfortunately, this PIX was purchased on Ebay... which I assume leaves me with no way of getting support on the product.

rsmith · ‎11-02-2005

Not sure if this applies, or why it would suddenly change, but looking at your running-config, is the Inside interface now set to "shutdown"? If not, I would concur that you have a hardware issue.

andyleealbrecht · ‎11-02-2005

Here's the info returned when I run 'show conf'

show conf

:

Saved

:

Written by enable_15 at 20:34:53.129 UTC Tue Nov 1 2005

PIX Version 6.3(4)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password N7FecZuSHJlVZC2P encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

hostname pix

domain-name ciscopix.local

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

<--- More ---> names

pager lines 24

mtu outside 1500

mtu inside 1500

no ip address outside

ip address inside 192.168.1.1 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

<--- More ---> no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

Cryptochecksum:4d7d25f4e03f1452ca1c82da531641b5

pix(config)#

Patrick Iseli · ‎11-02-2005

Wow does the show interface looks like ?

show interface

sincerely

Patrick