What version of PDM (PIX Version 6.2(4))

[Alf Martinsen]

Hi fellows, i am new to PIX, running 506. I try to get PDM installed, but i've got a Bad Magic number when downloading from ftp!

Have tried "downgrading" from ver 6.3(5) and from ver 6.2(4). What version of PDMxxx.bin should i use. Have tried from ver 6.3(5) to install pdm-304.bin, but that doesnt work either. I am new to this, and are currently studying for my CCNA!, so please have mercy!

[Patrick Iseli · Accepted solution]

For PIX OS 6.3.5 (pix635.bin) you will need PDM (pdm-304.bin).

Whan you download the image in FTP to your PC be sure that your are in binary mode, if you are in ASCII mode the image will be corrupt (bad checksum).

ftp x.x.x.x

loged in ...

bin

hash

get pdm-304.bin

#########...

exit

You should use TFTP do upload the image to the pix.

For PDM use:

pixfirewall# copy tftp://Your_TFTP_Server_IP_Address/Your_pdmfile_name flash:pdm

Or you can enter the generic command and follow the prompts:

pixfirewall# copy tftp flash:pdm

For PIX OS use:

Example - Upgrade the PIX Firewall with the copy tftp flash Command

pixfirewall# copy tftp flash

Address or name of remote host [127.0.0.1]? 172.18.125.3

Source file name [cdisk]? pix611.bin

copying tftp://172.18.125.3/pix611.bin to flash

[yes|no|again]? yes

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Received 2562048 bytes.

Erasing current image.

Writing 2469944 bytes of image.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Image installed.

pixfirewall#

PIX and PDM upgrade guide:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094a5d.shtml

sincerely

Patrick

[Alf Martinsen]

Hi, Patrick.

Yes it solved the problem. Thanks alot. I am up and running. PDM manager works. I can receive pppoe address at the outside int. Now it's on to get my LAN be able to access the internet via my PIX.

my net is as: lan-2940-(D-link)-PIX-ADSL modem. I have set up PIX to give out DHCP via inside int. D-link wireless, is only to provide wifi access. All host on the 2940. Do i need to make explicity access list to permit access to the outside. From within the PIX i can ping the ip addr on the other side of ADSL modem.

I know i have to work a lot on this myself, so i am not awaiting further more answers. Although a kick start would be fine,along the study path. ;-)

Regards

/alf

[Patrick Iseli]

No, you do not need to be explicit, with the Port Address Translation Networks, that it works but in security perspective it is allways better.

To access the the Internet from the inside to the outside interface you do not need an access-list. A higher security level (inside) can, if not blocked in an access-list on the inside interface, access the lower security levels (outside).

Example that allow all traffic from the inside interface to the internet.

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

route outside 0.0.0.0 0.0.0.0 Gateway 1

Example with defined networks:

global (outside) 1 interface

nat (inside) 1 192.168.1.0 255.255.255.0

nat (inside) 1 192.168.2.0 255.255.255.0

nat (inside) 1 10.10.10.0 255.255.255.0

route outside 0.0.0.0 0.0.0.0 Gateway 1

After chnaging the net settings do a:

clear xlate

# This will reset the Translation table (NAT)

See details in Cisco config guide 'Establishing Connectivity':

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172786.html

sincerely

Patrick

[Alf Martinsen]

Hi

Thanks again, get it to work, but since i attend to use it in my home network, it was to noisy..

I would soon by an 501 i think.

This was fun, and thank's again for helping me out.

/alf