Dial up Modem to Pix Console Port

Can this be done, and how?

I've tried just connecting the modem to the Pix501 with no success... has anyone done this success fully?

I have found documentaion for connecting a cisco router, but not the Pix series.

Thanks,
Lan
lannymAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
lrmooreConnect With a Mentor Commented:
Follow these steps exactly to attach a modem to the console port for dial-in out-of-band management of the router: (same for PIX)

1. Connect the modem to your PC’s open COM port (COM1 in this example) using the supplied 25-pin RJ45 adapter, rolled black or light blue cable, and 9-pin adapter.

2. Reset the modem to factory defaults. Set DIP Switch 7 to the down position and turn on the modem. Wait 10 seconds, turn the modem off. (Out of the box, 3, 5, and 8 are down, all others are up).

3. Set Modem DIP Switches 1, 3 and 8 down, all others up. Turn the modem back on.

4. Open HyperTerminal session direct to COM1.

5. Type AT <return>. You should see “OK”.

6. Type ATI4 to view the current modem settings:

U.S. Robotics 33600 Fax Settings...
   B0  E1  F1  M1  Q0  V1  X4  Y0    BAUD=9600  PARITY=N  WORDLEN=8    DIAL=TONE    ON HOOK   CID=0     &A3  &B1  &C1  &D0  &G0  &H1  &I0  &K1    &M4  &N0  &P0  &R2  &S0  &T5  &U0  &Y1     S00=001  S01=000  S02=043  S03=013  S04=010  S05=008  S06=002
   S07=060  S08=002  S09=006  S10=014  S11=070  S12=050  S13=000
   S15=000  S16=000  S18=000  S19=000  S21=010  S22=017  S23=019
   S25=005  S27=000  S28=008  S29=020  S30=000  S31=128  S32=002
   S33=000  S34=000  S35=000  S36=014  S38=000  S39=000  S40=001
   S41=000  S42=000

   LAST DIALED #:

7. Enter this command string exactly:
 ATE0F1Q1&I0&H0&K0&A0&B1&N6&C1&D0&W0

8. Type ATI4 again, this time you will not see it echoed back to the screen. When you hit <return> you should see this:
 U.S. Robotics 33600 Fax Settings...     B0  E0  F1  M1  Q1  V1  X4  Y0    BAUD=9600  PARITY=N  WORDLEN=8    DIAL=TONE    ON HOOK   CID=0     &A0  &B1  &C1  &D0  &G0  &H0  &I0  &K0    &M4  &N6  &P0  &R2  &S0  &T5  &U0  &Y1

   S00=001  S01=000  S02=043  S03=013  S04=010  S05=008  S06=002
   S07=060  S08=002  S09=006  S10=014  S11=070  S12=050  S13=000
   S15=000  S16=000  S18=000  S19=000  S21=010  S22=017  S23=019
   S25=005  S27=000  S28=008  S29=020  S30=000  S31=128  S32=002
   S33=000  S34=000  S35=000  S36=014  S38=000  S39=000  S40=001
   S41=000  S42=000

   LAST DIALED #:

9. Now turn the modem off. Set DIP switches 1, 4 and 8 down, all others up (put 3 up, bring 4 down).

10. Turn the modem back on, type ATI4 again to verify that the configuration has remained correct.

11.  Power on the Cisco router(or PIX), wait full 2 minutes before plugging the modem cable into the console port.

12.  Plug the RJ-45 cable into the console port of the router.

13.  Power on the Modem.

14.  Using HyperTerminal, dial the modem’s phone number.

15.  Once you are connected, you may not get a response for up to 20-30 seconds. Be patient young Jedi. Hit <return> a couple of times and you should get a router> prompt.

16. If you get connected, and see a rommon 1> prompt, the modem was probably plugged into the router too early. Simply type reset, confirm the reload and watch the router re-load the OS and then you should see the router> prompt.
0
 
polizatCommented:
what are you trying to do/achieve here lannym??
0
 
lannymAuthor Commented:
Sorry,

I would like to be able to dial the modem as a backup, to get into the Pix Console when offsite.

(I realize the security concerns here, a user would connect the phone line, and I would go in and configure the connection remotely. When the internet / vpn is not working correctly)
0
Improve Your Query Performance Tuning

In this FREE six-day email course, you'll learn from Janis Griffin, Database Performance Evangelist. She'll teach 12 steps that you can use to optimize your queries as much as possible and see measurable results in your work. Get started today!

 
PennGwynCommented:
Does the PIX have an AUX port?  Cisco routers have both, and the AUX has features which make it a better choice for a modem.

Note that the serial ports on modems are wired DCE rather than DTE.  You may need to insert a crossover if you're using a console cable.  (I believe some Cisco routers come with three connectors for the rolled cable:  9-pin DTE, 25-pin DTE, and 25-pin DCE.)

0
 
lannymAuthor Commented:
I'll have to look for some connectors, but I'm sure the pix didn't come with any... I did get a gender changer to connect the blue console cable to the modem serial port... but that is it.

0
 
hawgpigCommented:
This can be done but is not supported by cisco.......and I wouldn't recommend setting it up....IT IS A SERIOUS PAIN and will occasoinally fail!! The modem settings have to be just right and to tell you the truth I just plain don't remember them.
If you are looking for a way to remotely configure your pix in case it goes down.
Try using a computer on the inside
Set it's modem up to connect.....
it is better if you can connect to a WIN2K server and set up remote dial-in
and use tightVNC to get to the computer and
configure the pix via telnet or PDM from there......
Here is a link to tightVNC....
http://www.snapfiles.com/freeware/network/fwremote.html
Just one alternative....
Good Luck
0
 
hawgpigCommented:
Oops also fogot to mention the console cable of the pxi should be plugged in to the computer you are going to access.....This way you can get to the console if you have to....
0
 
polizatCommented:
Does this mean your dial up connection is going to terminate at the modem, then you'll Hypertrm from the modem to the PIX?? If not - is it going to terminate on the PIX? In which case can't you set up the PIX with a VTY session instead of having to do all the cable changing etc??
0
 
Tim HolmanCommented:
There are far more secure ways of accessing the PIX offsite.  For example, you could setup a VPN Client (using 3-DES or AES), or PIX PDM (which uses SSL) ?
Dial-up straight into a console port will give attackers UNLIMITED chances at cracking the passwords.
Also, it's VERY UNLIKELY will fail and only give you console access.  If a PIX goes down, it's usually down to a hardware fault.
If you're worried you'll lock yourself out after an unsuccessful config change, then all you have to do is reboot to restore the boot-up config, so as long as someone's on site, then not a problem.
0
 
lrmooreCommented:
I hate to spoil the fun, but offer this anyway.
Of course you can attach a modem directly to the console port. Depending on your particular modem, set it for 9600 baud only, no local echo, and auto answer. It could be dip switches, init strings, or a combination of both. I can provide the procedure for USR sportster modem.

You can mitigate the risks by using a "secure" modem that provides a first level username challenge/password before you get to the PIX console which should then be configured for yet another username/password challenge.
Use good password and local authentication for serial access and you should have no fear.

Alternatively, you can connect the console port to a router's AUX port. If you can get to the router, use a reverse telnet connection to the aux port and viola' you have console access to the PIX. This also gives you multiple levels of access control.

We resell managed services for routers and firewalls and a requirement is out of band access via modem. Depending on client requirements, it could be with a secure console port server with modem, or just a modem connected direct to the console port.
0
 
lannymAuthor Commented:
I have a USR Sportster modem, and if you could provide the procedure that would be great! I'd like to try it.

( ToAll: I appreciate your security concerns, however, this phone line likely would only be connected by a tech when I say so... then I can get in remotely should I not be able to get in any other way. )

Thanks for you help...

Lan
0
 
lannymAuthor Commented:
I'm trying the instructions on a PIX501... with no sucess... everthing looks ok as far as the modem config goes.

Here is a rundown of what I have... Pix 501 (blue cisco console RJ45 to serial cable).. connected to gender changer.. connected to cable to modem... sound right?

Modems connect... and after several minutes, still no response on the screen.

any ideas?

Thanks!
Lan
0
 
lrmooreCommented:
Probably wrong pinout if you are using a light blud cable that has RJ-45 on one end and 9pin on the other, with a 9-pin 25 pin adapter.
You need a 25-pin/rj45 modem connector adapter, and the black modem cable with rj-45 at both ends, or the black modem cable that comes with the new Cisco products that has RJ45 on one end and 25-pin on the other end.
0
 
jon47Commented:
I think you've got the cabling wrong... I recall that the pix series firewalls have a serial port that's wired the opposite to what you might expect.  (I had problems getting my pix-515 to talk to anything for a while.)  Try putting a null modem between your modem and the pix, or alternatively use an ethernet crossover cable into the rj45/db25 adapter that came with the pix.

Jon
0
 
lannymAuthor Commented:
Does anyone know the cisco part numbers of the required cables / adapters needed to connect the pix501 to a modem? I have the blue RJ45 (pix) to DB9 Serial (computer)

Thanks,
Lan
0
 
lrmooreCommented:
CAB-25AS-MMOD
Or you can get a generic 25-pin/RJ-45 Modem adapter
http://catalog.blackbox.com/BlackBox/Templates/blackbox/mainscreen.asp
0
 
lannymAuthor Commented:
Just an Update...

All is working well with the supplied PIX 501 (Blue flat rj45 to serial) cable and a Cisco 25pin to 9pin adapter (Cisco Part # 29-4043-01) attached to the USR Modem.

( I found the adapter with a Cisco router that was recently installed )

Thanks to everyone who helped.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.