Solved

Dial up Modem to Pix Console Port

Posted on 2004-04-12
17
3,792 Views
Last Modified: 2013-11-16
Can this be done, and how?

I've tried just connecting the modem to the Pix501 with no success... has anyone done this success fully?

I have found documentaion for connecting a cisco router, but not the Pix series.

Thanks,
Lan
0
Comment
Question by:lannym
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
  • 2
  • +4
17 Comments
 

Expert Comment

by:polizat
ID: 10813016
what are you trying to do/achieve here lannym??
0
 

Author Comment

by:lannym
ID: 10814958
Sorry,

I would like to be able to dial the modem as a backup, to get into the Pix Console when offsite.

(I realize the security concerns here, a user would connect the phone line, and I would go in and configure the connection remotely. When the internet / vpn is not working correctly)
0
 
LVL 11

Expert Comment

by:PennGwyn
ID: 10815057
Does the PIX have an AUX port?  Cisco routers have both, and the AUX has features which make it a better choice for a modem.

Note that the serial ports on modems are wired DCE rather than DTE.  You may need to insert a crossover if you're using a console cable.  (I believe some Cisco routers come with three connectors for the rolled cable:  9-pin DTE, 25-pin DTE, and 25-pin DCE.)

0
Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

 

Author Comment

by:lannym
ID: 10815845
I'll have to look for some connectors, but I'm sure the pix didn't come with any... I did get a gender changer to connect the blue console cable to the modem serial port... but that is it.

0
 
LVL 4

Expert Comment

by:hawgpig
ID: 10818707
This can be done but is not supported by cisco.......and I wouldn't recommend setting it up....IT IS A SERIOUS PAIN and will occasoinally fail!! The modem settings have to be just right and to tell you the truth I just plain don't remember them.
If you are looking for a way to remotely configure your pix in case it goes down.
Try using a computer on the inside
Set it's modem up to connect.....
it is better if you can connect to a WIN2K server and set up remote dial-in
and use tightVNC to get to the computer and
configure the pix via telnet or PDM from there......
Here is a link to tightVNC....
http://www.snapfiles.com/freeware/network/fwremote.html
Just one alternative....
Good Luck
0
 
LVL 4

Expert Comment

by:hawgpig
ID: 10818774
Oops also fogot to mention the console cable of the pxi should be plugged in to the computer you are going to access.....This way you can get to the console if you have to....
0
 

Expert Comment

by:polizat
ID: 10821349
Does this mean your dial up connection is going to terminate at the modem, then you'll Hypertrm from the modem to the PIX?? If not - is it going to terminate on the PIX? In which case can't you set up the PIX with a VTY session instead of having to do all the cable changing etc??
0
 
LVL 23

Expert Comment

by:Tim Holman
ID: 10822276
There are far more secure ways of accessing the PIX offsite.  For example, you could setup a VPN Client (using 3-DES or AES), or PIX PDM (which uses SSL) ?
Dial-up straight into a console port will give attackers UNLIMITED chances at cracking the passwords.
Also, it's VERY UNLIKELY will fail and only give you console access.  If a PIX goes down, it's usually down to a hardware fault.
If you're worried you'll lock yourself out after an unsuccessful config change, then all you have to do is reboot to restore the boot-up config, so as long as someone's on site, then not a problem.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 10843070
I hate to spoil the fun, but offer this anyway.
Of course you can attach a modem directly to the console port. Depending on your particular modem, set it for 9600 baud only, no local echo, and auto answer. It could be dip switches, init strings, or a combination of both. I can provide the procedure for USR sportster modem.

You can mitigate the risks by using a "secure" modem that provides a first level username challenge/password before you get to the PIX console which should then be configured for yet another username/password challenge.
Use good password and local authentication for serial access and you should have no fear.

Alternatively, you can connect the console port to a router's AUX port. If you can get to the router, use a reverse telnet connection to the aux port and viola' you have console access to the PIX. This also gives you multiple levels of access control.

We resell managed services for routers and firewalls and a requirement is out of band access via modem. Depending on client requirements, it could be with a secure console port server with modem, or just a modem connected direct to the console port.
0
 

Author Comment

by:lannym
ID: 10844167
I have a USR Sportster modem, and if you could provide the procedure that would be great! I'd like to try it.

( ToAll: I appreciate your security concerns, however, this phone line likely would only be connected by a tech when I say so... then I can get in remotely should I not be able to get in any other way. )

Thanks for you help...

Lan
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 10846027
Follow these steps exactly to attach a modem to the console port for dial-in out-of-band management of the router: (same for PIX)

1. Connect the modem to your PC’s open COM port (COM1 in this example) using the supplied 25-pin RJ45 adapter, rolled black or light blue cable, and 9-pin adapter.

2. Reset the modem to factory defaults. Set DIP Switch 7 to the down position and turn on the modem. Wait 10 seconds, turn the modem off. (Out of the box, 3, 5, and 8 are down, all others are up).

3. Set Modem DIP Switches 1, 3 and 8 down, all others up. Turn the modem back on.

4. Open HyperTerminal session direct to COM1.

5. Type AT <return>. You should see “OK”.

6. Type ATI4 to view the current modem settings:

U.S. Robotics 33600 Fax Settings...
   B0  E1  F1  M1  Q0  V1  X4  Y0    BAUD=9600  PARITY=N  WORDLEN=8    DIAL=TONE    ON HOOK   CID=0     &A3  &B1  &C1  &D0  &G0  &H1  &I0  &K1    &M4  &N0  &P0  &R2  &S0  &T5  &U0  &Y1     S00=001  S01=000  S02=043  S03=013  S04=010  S05=008  S06=002
   S07=060  S08=002  S09=006  S10=014  S11=070  S12=050  S13=000
   S15=000  S16=000  S18=000  S19=000  S21=010  S22=017  S23=019
   S25=005  S27=000  S28=008  S29=020  S30=000  S31=128  S32=002
   S33=000  S34=000  S35=000  S36=014  S38=000  S39=000  S40=001
   S41=000  S42=000

   LAST DIALED #:

7. Enter this command string exactly:
 ATE0F1Q1&I0&H0&K0&A0&B1&N6&C1&D0&W0

8. Type ATI4 again, this time you will not see it echoed back to the screen. When you hit <return> you should see this:
 U.S. Robotics 33600 Fax Settings...     B0  E0  F1  M1  Q1  V1  X4  Y0    BAUD=9600  PARITY=N  WORDLEN=8    DIAL=TONE    ON HOOK   CID=0     &A0  &B1  &C1  &D0  &G0  &H0  &I0  &K0    &M4  &N6  &P0  &R2  &S0  &T5  &U0  &Y1

   S00=001  S01=000  S02=043  S03=013  S04=010  S05=008  S06=002
   S07=060  S08=002  S09=006  S10=014  S11=070  S12=050  S13=000
   S15=000  S16=000  S18=000  S19=000  S21=010  S22=017  S23=019
   S25=005  S27=000  S28=008  S29=020  S30=000  S31=128  S32=002
   S33=000  S34=000  S35=000  S36=014  S38=000  S39=000  S40=001
   S41=000  S42=000

   LAST DIALED #:

9. Now turn the modem off. Set DIP switches 1, 4 and 8 down, all others up (put 3 up, bring 4 down).

10. Turn the modem back on, type ATI4 again to verify that the configuration has remained correct.

11.  Power on the Cisco router(or PIX), wait full 2 minutes before plugging the modem cable into the console port.

12.  Plug the RJ-45 cable into the console port of the router.

13.  Power on the Modem.

14.  Using HyperTerminal, dial the modem’s phone number.

15.  Once you are connected, you may not get a response for up to 20-30 seconds. Be patient young Jedi. Hit <return> a couple of times and you should get a router> prompt.

16. If you get connected, and see a rommon 1> prompt, the modem was probably plugged into the router too early. Simply type reset, confirm the reload and watch the router re-load the OS and then you should see the router> prompt.
0
 

Author Comment

by:lannym
ID: 10855010
I'm trying the instructions on a PIX501... with no sucess... everthing looks ok as far as the modem config goes.

Here is a rundown of what I have... Pix 501 (blue cisco console RJ45 to serial cable).. connected to gender changer.. connected to cable to modem... sound right?

Modems connect... and after several minutes, still no response on the screen.

any ideas?

Thanks!
Lan
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 10859376
Probably wrong pinout if you are using a light blud cable that has RJ-45 on one end and 9pin on the other, with a 9-pin 25 pin adapter.
You need a 25-pin/rj45 modem connector adapter, and the black modem cable with rj-45 at both ends, or the black modem cable that comes with the new Cisco products that has RJ45 on one end and 25-pin on the other end.
0
 
LVL 2

Expert Comment

by:jon47
ID: 10863673
I think you've got the cabling wrong... I recall that the pix series firewalls have a serial port that's wired the opposite to what you might expect.  (I had problems getting my pix-515 to talk to anything for a while.)  Try putting a null modem between your modem and the pix, or alternatively use an ethernet crossover cable into the rj45/db25 adapter that came with the pix.

Jon
0
 

Author Comment

by:lannym
ID: 10908036
Does anyone know the cisco part numbers of the required cables / adapters needed to connect the pix501 to a modem? I have the blue RJ45 (pix) to DB9 Serial (computer)

Thanks,
Lan
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 10909308
CAB-25AS-MMOD
Or you can get a generic 25-pin/RJ-45 Modem adapter
http://catalog.blackbox.com/BlackBox/Templates/blackbox/mainscreen.asp
0
 

Author Comment

by:lannym
ID: 10990964
Just an Update...

All is working well with the supplied PIX 501 (Blue flat rj45 to serial) cable and a Cisco 25pin to 9pin adapter (Cisco Part # 29-4043-01) attached to the USR Modem.

( I found the adapter with a Cisco router that was recently installed )

Thanks to everyone who helped.
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A 2007 NCSA Cyber Security survey revealed that a mere 4% of the population has a full understanding of firewalls. As business owner, you should be part of that 4% that has a full understanding.
Liquid Web and Plesk discuss how to simplify server management with a single tool  in their webinar.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
This video Micro Tutorial shows how to password-protect PDF files with free software. Many software products can do this, such as Adobe Acrobat (but not Adobe Reader), Nuance PaperPort, and Nuance Power PDF, but they are not free products. This vide…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question