Remote Access

The PIX Firewall, like many other Cisco devices, provides a graphical user interface that can be used for configuration tasks. Two configuration mode http commands are required to use a web browser, such as Internet Explorer, to access the firewall console. The http server enable command turns on the feature. The second command defines the host(s) that can use the feature. It’s possible to have up to 16 simultaneous HTTP console sessions. Use the no form of each command to remove the configuration. The syntax is

Pix(config)# http server enable
Pix(config)# [no] http server enable
Pix(config)# http ip_address [netmask] [if_name]
Pix(config)# no http ip_address [netmask] [if_name]

The default netmask is 255.255.255.255 or the host address mask. The default if_name is the inside interface. To allow any host, use 0.0.0.0 0.0.0.0 (or 0 0) for ip_address and netmask. In the following, the first example shows a single host (1.1.1.11) allowed to use a web browser to access from the outside, while the entire 192.168.1.0 network can access the inside address. The second example allows all internal hosts to access any inside interface on the PIX unit using a web browser.

Pix(config)# http server enable
Pix(config)# http 1.1.1.11 outside
Pix(config)# http 192.168.1.0 255.255.255.0

Pix2(config)# http server enable
Pix2(config)# http 0 0 
Pix2(config)# show http
0.0.0.0 0.0.0.0 inside
Pix2(config)#

The PIX Firewall supports SSH console access for configuration tasks. The configuration mode ssh ip_address command defines the host(s) or network(s) that can initiate an SSH connection to the PIX Firewall. The no form of the command removes the address(es). The syntax is

Pix(config)# ssh ip_address [netmask] [if_name]
Pix(config)# no ssh ip_address [netmask] [if_name]
Pix(config)# ssh timeout minutes

The no ssh ip_address command removes the specified ssh command statement from the configuration, while the clear ssh command removes all ssh command statements.

No default netmask exists. The default if_name is all inside interfaces. To allow any host, use 0.0.0.0 0.0.0.0 (or 0 0) for ip_address and netmask.

The ssh timeout command defines an idle timer of 1 to 60 minutes (default is five minutes).

The show ssh command shows the addresses that are allowed SSH access. The show ssh sessions command displays all active SSH sessions to the PIX Firewall. The output includes a session ID for each connection. The ssh disconnect session_id command will disconnect the specific session. The following output demonstrates the previous commands:

To use SSH, your PIX Firewall must have a DES or 3DES activation key.

To gain access to the PIX Firewall console via SSH, when prompted for the user name and password, use pix and the Telnet password (set with the passwd command). SSH permits user names up to 100 characters and passwords up to 50 characters.

The PIX Firewall supports AAA authentication for Telnet, HTTP, and SSH sessions using the aaa authentication command. Use the no form of the command to turn off the authentication. The syntax is

Pix(config)# aaa authentication [serial | enable | telnet | ssh | http] console group_tag
Pix(config)# no aaa authentication [serial | enable | telnet | ssh | http] console group_tag