EasyManua.ls Logo

Cisco Catalyst 6500 Series User Manual

Cisco Catalyst 6500 Series
392 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #212 background imageLoading...
Page #212 background image
11-4
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide
OL-6392-01
Chapter 11 Allowing Remote Management
Allowing HTTPS for PDM
Using an SSH Client
To gain access to the FWSM console using SSH, at the SSH client enter the username pix and enter the
login password set by the password command (see the “Changing the Login Password” section on
page 6-2). For individual logins, see the “Configuring Authentication for CLI Access” section on
page 12-8.
When starting an SSH session, a dot (.) displays on the FWSM console before the SSH user
authentication prompt appears, as follows:
FWSM/contexta(config)# .
The display of the dot does not affect the functionality of SSH. The dot appears at the console when
generating a server key or decrypting a message using private keys during SSH key exchange before user
authentication occurs. These tasks can take up to two minutes or longer. The dot is a progress indicator
that verifies that the FWSM is busy and has not hung.
Allowing HTTPS for PDM
To use PDM, you need to enable the HTTPS server and allow HTTPS connections to the FWSM. All of
these tasks are completed if you use the setup command. This section describes how to manually
configure PDM access.
The FWSM allows up to 32 PDM sessions for the entire modul, and it allows a maximum of 5 concurrent
HTTPS connections per context, which can be configurable. See the “Rule Limits” section on page A-5
for information about the maximum number of HTTPS rules allowed for the entire system.
To configure PDM access, follow these steps:
Step 1 To generate an RSA key pair, which is required for HTTPS, enter the following command:
FWSM/contexta(config)# ca generate rsa key
modulus
The modulus (in bits) is 512, 768, 1024, or 2048. The larger the key modulus size you specify, the longer
it takes to generate an RSA. We recommend a value of 768.
Before you generate the key, you should set the host name and the domain name according to the
“Setting the Host Name” section on page 6-4 and the “Setting the Domain Name” section on page 6-5.
These settings are used in the key.
Step 2 To save the RSA keys to persistent Flash memory, enter the following command:
FWSM/contexta(config)# ca save all
Step 3 To identify the IP addresses from which the FWSM accepts HTTPS connections, enter the following
command for each address or subnet:
FWSM/contexta(config)# http
source_IP_address
mask
source_interface
Step 4 To enable the HTTPS server, enter the following command:
FWSM/contexta(config)# http server enable
Step 5 To enable PDM metrics history, enter the following command:
FWSM/contexta(config)# pdm history enable
If you do not enable PDM metrics history, you can view real-time data only and not historical data. This
step is optional.

Table of Contents

Other manuals for Cisco Catalyst 6500 Series

Questions and Answers:

Cisco Catalyst 6500 Series Specifications

General IconGeneral
Product TypeSwitch
Switch TypeModular
Switching CapacityUp to 720 Gbps
Forwarding RateUp to 400 Mpps
ModularYes
Uplink PortsVaries by module
QoSYes
Rack-mountableYes
SeriesCatalyst 6500
Power over Ethernet (PoE)Available on some models
Operating SystemCisco IOS
RedundancyYes (Supervisor engine, power supply)
Form FactorChassis-based
Slot Count3, 6, 9, or 13 slots
ManagementCLI, SNMP
Security FeaturesACLs, 802.1X, port security
VLAN SupportYes

Summary

Introduction to the Firewall Services Module

Stateful Inspection Feature

Explains how the FWSM inspects traffic using the Adaptive Security Algorithm and session management path.

Security Contexts

Describes how to partition a single FWSM into multiple virtual firewalls (security contexts).

Connecting to the Firewall Services Module and Managing the Configuration

Sessioning and Logging into the Firewall Services Module

Details how to connect to the FWSM CLI, log in, and access configuration mode.

Configuring the Firewall Mode

Setting the Firewall Mode

Details how to set the FWSM to run in routed or transparent firewall mode.

Managing Security Contexts

Security Context Overview

Explains security contexts as virtual firewalls within a single FWSM.

Enabling or Disabling Multiple Context Mode

Provides procedures to convert from single to multiple context mode and vice versa.

Configuring Resource Management

Details how to configure resource limits per context to prevent resource overuse.

Configuring a Security Context

Describes how to add a security context, including VLANs, resource class, and configuration URL.

Configuring Basic Settings

Changing the Passwords

Covers changing login, enable, and maintenance partition passwords for security.

Configuring Interfaces

Explains how to name and assign security levels to interfaces for full FWSM configuration.

Configuring Bridging Parameters and ARP Inspection

Configuring ARP Inspection

Describes how to enable and configure ARP inspection to prevent ARP spoofing.

Configuring IP Addresses, Routing, and DHCP

Configuring IP Addresses

Details setting IP addresses for routed or transparent firewall modes.

Configuring the Default Route

Explains how to configure the default route for FWSM traffic to reach unknown destinations.

Configuring Static Routes

Describes how to configure static routes for networks not directly connected to the FWSM.

Configuring the DHCP Server

Details how to use the Dynamic Host Configuration Protocol (DHCP) server provided by the FWSM.

Configuring DHCP Relay

Describes how to configure the FWSM to forward DHCP requests to a connected router.

Configuring Network Address Translation

NAT Overview

Explains how Network Address Translation (NAT) works on the FWSM.

Dynamic NAT

Explains how dynamic NAT translates local addresses to a pool of global addresses.

PAT

Describes PAT, which translates multiple local addresses to a single global IP address and unique port.

Static NAT

Explains how static NAT translates each local address to a fixed global address.

Static PAT

Details static PAT, which translates local IP to global IP and local port to global port.

Controlling Network Access with Access Control Lists

Access Control List Overview

Provides an overview of ACLs, their components (ACEs), and general guidelines for creation.

Controlling Network Access for IP Traffic (Extended)

Explains how to use extended ACLs to control IP traffic based on source, destination, protocol, or port.

Adding an Extended Access Control List

Provides step-by-step instructions for adding extended ACEs to an ACL.

Simplifying Access Control Lists with Object Grouping

Describes using object groups to simplify ACL creation and maintenance.

Allowing Remote Management

Allowing Telnet

Covers configuring Telnet access to the FWSM for management purposes.

Allowing SSH

Explains how to configure SSH access for secure management connections to the FWSM.

Allowing a VPN Management Connection

Describes how to configure IPSec VPN tunnels for secure management access.

Configuring AAA

AAA Overview

Introduces AAA (Authentication, Authorization, Accounting) for user access control.

Configuring the Local Database

Describes how to manage users in the local database for CLI and VPN access authentication.

Configuring Authentication for CLI Access

Explains how to configure username/password authentication for CLI login and enable commands.

Configuring Authentication to Access Privileged Mode

Details configuring authentication for users entering the enable or login commands.

Configuring Command Authorization

Describes how to control user access to specific commands via privilege levels or TACACS+.

Configuring Local Command Authorization

Explains how to assign commands to privilege levels and enable local command authorization.

Configuring TACACS+ Command Authorization

Details configuring TACACS+ for command authorization by checking commands against the server.

Recovering from a Lockout

Provides common lockout conditions and workarounds for CLI authentication and command authorization.

Configuring Authentication for Network Access

Describes configuring RADIUS or TACACS+ for network access authentication.

Enabling Network Access Authentication

Explains how to enable network access authentication using an ACL and a server group.

Configuring Authorization for Network Access

Describes configuring authorization rules or dynamic ACLs for network traffic access.

Configuring TACACS+ Authorization

Explains how to configure network access authorization using TACACS+ servers.

Configuring RADIUS Authorization

Describes how to configure RADIUS servers to download ACLs for per-user authorization.

Configuring Accounting for Network Access

Details how to send accounting information to RADIUS or TACACS+ servers for traffic tracking.

Configuring Application Protocol Inspection

Inspection Engine Overview

Provides an overview of application protocol inspection (fixup) and its impact on throughput.

Configuring an Inspection Engine

Provides instructions on how to configure or disable inspection engines for various protocols.

Filtering HTTP, HTTPS, or FTP Requests Using an External Server

Filtering Overview

Discusses using external servers for practical web and FTP filtering over ACLs.

Configuring General Filtering Parameters

Details FWSM communication with filtering servers, handling errors, long URLs, and caching.

Using Failover

Configuring Failover

Provides detailed steps to configure failover for the primary and secondary modules.

Verifying the Failover Configuration

Explains how to verify the failover configuration using the 'show failover' command.

Managing Software and Configuration Files

Installing Application or PDM Software

Details how to install or upgrade application, PDM, or maintenance software.

Installing Application or PDM Software to the Current Partition

Explains copying application or PDM software to the current partition from a server.

Downloading and Backing Up Configuration Files

Covers downloading text configurations and backing up configuration files.

Backing Up the Configuration

Explains methods to back up configuration to an external server or terminal display.

Copying the Configuration to a Server

Details backing up single-mode or multiple-mode system configurations to an external server.

Monitoring and Troubleshooting the Firewall Services Module

Troubleshooting the Firewall Services Module

Provides steps and techniques for troubleshooting FWSM issues.

Testing Your Configuration

Guides on testing FWSM connectivity, pinging interfaces, and verifying traffic flow.

Troubleshooting Passwords and AAA

Details how to recover from forgotten passwords or AAA lockout situations.

Sample Configurations

Example 1: Security Contexts With Outside Access

Example of creating multiple security contexts with inside, outside, and DMZ interfaces.

Example 5: Security Contexts With Outside Access

Example of transparent mode FWSM with multiple contexts and outside access.

Related product manuals