Solved

Dial up Modem to Pix Console Port

Posted on 2004-04-12
17
3,782 Views
Last Modified: 2013-11-16
Can this be done, and how?

I've tried just connecting the modem to the Pix501 with no success... has anyone done this success fully?

I have found documentaion for connecting a cisco router, but not the Pix series.

Thanks,
Lan
0
Comment
Question by:lannym
  • 6
  • 4
  • 2
  • +4
17 Comments
 

Expert Comment

by:polizat
Comment Utility
what are you trying to do/achieve here lannym??
0
 

Author Comment

by:lannym
Comment Utility
Sorry,

I would like to be able to dial the modem as a backup, to get into the Pix Console when offsite.

(I realize the security concerns here, a user would connect the phone line, and I would go in and configure the connection remotely. When the internet / vpn is not working correctly)
0
 
LVL 11

Expert Comment

by:PennGwyn
Comment Utility
Does the PIX have an AUX port?  Cisco routers have both, and the AUX has features which make it a better choice for a modem.

Note that the serial ports on modems are wired DCE rather than DTE.  You may need to insert a crossover if you're using a console cable.  (I believe some Cisco routers come with three connectors for the rolled cable:  9-pin DTE, 25-pin DTE, and 25-pin DCE.)

0
 

Author Comment

by:lannym
Comment Utility
I'll have to look for some connectors, but I'm sure the pix didn't come with any... I did get a gender changer to connect the blue console cable to the modem serial port... but that is it.

0
 
LVL 4

Expert Comment

by:hawgpig
Comment Utility
This can be done but is not supported by cisco.......and I wouldn't recommend setting it up....IT IS A SERIOUS PAIN and will occasoinally fail!! The modem settings have to be just right and to tell you the truth I just plain don't remember them.
If you are looking for a way to remotely configure your pix in case it goes down.
Try using a computer on the inside
Set it's modem up to connect.....
it is better if you can connect to a WIN2K server and set up remote dial-in
and use tightVNC to get to the computer and
configure the pix via telnet or PDM from there......
Here is a link to tightVNC....
http://www.snapfiles.com/freeware/network/fwremote.html
Just one alternative....
Good Luck
0
 
LVL 4

Expert Comment

by:hawgpig
Comment Utility
Oops also fogot to mention the console cable of the pxi should be plugged in to the computer you are going to access.....This way you can get to the console if you have to....
0
 

Expert Comment

by:polizat
Comment Utility
Does this mean your dial up connection is going to terminate at the modem, then you'll Hypertrm from the modem to the PIX?? If not - is it going to terminate on the PIX? In which case can't you set up the PIX with a VTY session instead of having to do all the cable changing etc??
0
 
LVL 23

Expert Comment

by:Tim Holman
Comment Utility
There are far more secure ways of accessing the PIX offsite.  For example, you could setup a VPN Client (using 3-DES or AES), or PIX PDM (which uses SSL) ?
Dial-up straight into a console port will give attackers UNLIMITED chances at cracking the passwords.
Also, it's VERY UNLIKELY will fail and only give you console access.  If a PIX goes down, it's usually down to a hardware fault.
If you're worried you'll lock yourself out after an unsuccessful config change, then all you have to do is reboot to restore the boot-up config, so as long as someone's on site, then not a problem.
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
I hate to spoil the fun, but offer this anyway.
Of course you can attach a modem directly to the console port. Depending on your particular modem, set it for 9600 baud only, no local echo, and auto answer. It could be dip switches, init strings, or a combination of both. I can provide the procedure for USR sportster modem.

You can mitigate the risks by using a "secure" modem that provides a first level username challenge/password before you get to the PIX console which should then be configured for yet another username/password challenge.
Use good password and local authentication for serial access and you should have no fear.

Alternatively, you can connect the console port to a router's AUX port. If you can get to the router, use a reverse telnet connection to the aux port and viola' you have console access to the PIX. This also gives you multiple levels of access control.

We resell managed services for routers and firewalls and a requirement is out of band access via modem. Depending on client requirements, it could be with a secure console port server with modem, or just a modem connected direct to the console port.
0
 

Author Comment

by:lannym
Comment Utility
I have a USR Sportster modem, and if you could provide the procedure that would be great! I'd like to try it.

( ToAll: I appreciate your security concerns, however, this phone line likely would only be connected by a tech when I say so... then I can get in remotely should I not be able to get in any other way. )

Thanks for you help...

Lan
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
Comment Utility
Follow these steps exactly to attach a modem to the console port for dial-in out-of-band management of the router: (same for PIX)

1. Connect the modem to your PC’s open COM port (COM1 in this example) using the supplied 25-pin RJ45 adapter, rolled black or light blue cable, and 9-pin adapter.

2. Reset the modem to factory defaults. Set DIP Switch 7 to the down position and turn on the modem. Wait 10 seconds, turn the modem off. (Out of the box, 3, 5, and 8 are down, all others are up).

3. Set Modem DIP Switches 1, 3 and 8 down, all others up. Turn the modem back on.

4. Open HyperTerminal session direct to COM1.

5. Type AT <return>. You should see “OK”.

6. Type ATI4 to view the current modem settings:

U.S. Robotics 33600 Fax Settings...
   B0  E1  F1  M1  Q0  V1  X4  Y0    BAUD=9600  PARITY=N  WORDLEN=8    DIAL=TONE    ON HOOK   CID=0     &A3  &B1  &C1  &D0  &G0  &H1  &I0  &K1    &M4  &N0  &P0  &R2  &S0  &T5  &U0  &Y1     S00=001  S01=000  S02=043  S03=013  S04=010  S05=008  S06=002
   S07=060  S08=002  S09=006  S10=014  S11=070  S12=050  S13=000
   S15=000  S16=000  S18=000  S19=000  S21=010  S22=017  S23=019
   S25=005  S27=000  S28=008  S29=020  S30=000  S31=128  S32=002
   S33=000  S34=000  S35=000  S36=014  S38=000  S39=000  S40=001
   S41=000  S42=000

   LAST DIALED #:

7. Enter this command string exactly:
 ATE0F1Q1&I0&H0&K0&A0&B1&N6&C1&D0&W0

8. Type ATI4 again, this time you will not see it echoed back to the screen. When you hit <return> you should see this:
 U.S. Robotics 33600 Fax Settings...     B0  E0  F1  M1  Q1  V1  X4  Y0    BAUD=9600  PARITY=N  WORDLEN=8    DIAL=TONE    ON HOOK   CID=0     &A0  &B1  &C1  &D0  &G0  &H0  &I0  &K0    &M4  &N6  &P0  &R2  &S0  &T5  &U0  &Y1

   S00=001  S01=000  S02=043  S03=013  S04=010  S05=008  S06=002
   S07=060  S08=002  S09=006  S10=014  S11=070  S12=050  S13=000
   S15=000  S16=000  S18=000  S19=000  S21=010  S22=017  S23=019
   S25=005  S27=000  S28=008  S29=020  S30=000  S31=128  S32=002
   S33=000  S34=000  S35=000  S36=014  S38=000  S39=000  S40=001
   S41=000  S42=000

   LAST DIALED #:

9. Now turn the modem off. Set DIP switches 1, 4 and 8 down, all others up (put 3 up, bring 4 down).

10. Turn the modem back on, type ATI4 again to verify that the configuration has remained correct.

11.  Power on the Cisco router(or PIX), wait full 2 minutes before plugging the modem cable into the console port.

12.  Plug the RJ-45 cable into the console port of the router.

13.  Power on the Modem.

14.  Using HyperTerminal, dial the modem’s phone number.

15.  Once you are connected, you may not get a response for up to 20-30 seconds. Be patient young Jedi. Hit <return> a couple of times and you should get a router> prompt.

16. If you get connected, and see a rommon 1> prompt, the modem was probably plugged into the router too early. Simply type reset, confirm the reload and watch the router re-load the OS and then you should see the router> prompt.
0
 

Author Comment

by:lannym
Comment Utility
I'm trying the instructions on a PIX501... with no sucess... everthing looks ok as far as the modem config goes.

Here is a rundown of what I have... Pix 501 (blue cisco console RJ45 to serial cable).. connected to gender changer.. connected to cable to modem... sound right?

Modems connect... and after several minutes, still no response on the screen.

any ideas?

Thanks!
Lan
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Probably wrong pinout if you are using a light blud cable that has RJ-45 on one end and 9pin on the other, with a 9-pin 25 pin adapter.
You need a 25-pin/rj45 modem connector adapter, and the black modem cable with rj-45 at both ends, or the black modem cable that comes with the new Cisco products that has RJ45 on one end and 25-pin on the other end.
0
 
LVL 2

Expert Comment

by:jon47
Comment Utility
I think you've got the cabling wrong... I recall that the pix series firewalls have a serial port that's wired the opposite to what you might expect.  (I had problems getting my pix-515 to talk to anything for a while.)  Try putting a null modem between your modem and the pix, or alternatively use an ethernet crossover cable into the rj45/db25 adapter that came with the pix.

Jon
0
 

Author Comment

by:lannym
Comment Utility
Does anyone know the cisco part numbers of the required cables / adapters needed to connect the pix501 to a modem? I have the blue RJ45 (pix) to DB9 Serial (computer)

Thanks,
Lan
0
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
CAB-25AS-MMOD
Or you can get a generic 25-pin/RJ-45 Modem adapter
http://catalog.blackbox.com/BlackBox/Templates/blackbox/mainscreen.asp
0
 

Author Comment

by:lannym
Comment Utility
Just an Update...

All is working well with the supplied PIX 501 (Blue flat rj45 to serial) cable and a Cisco 25pin to 9pin adapter (Cisco Part # 29-4043-01) attached to the USR Modem.

( I found the adapter with a Cisco router that was recently installed )

Thanks to everyone who helped.
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now