Solved

Allow Telnet from different subnets Cisco 501 PIX

Posted on 2008-06-13
3
560 Views
Last Modified: 2011-10-03
We have a Cisco 501 PIX at a remote branch that is connected to the main office via VPN.  How do you configure the PIX so that I can telnet into it from the main office LAN.  The remote office is on a 192.168.2.0 subnet and the main office is on a 192.168.1.0 subnet.  They are at different physical locations with different public addresses. Do I have to allow the public address of the main office through on the PIX of the remote office or can it be done "internally" via the subnets.
0
Comment
Question by:kennedy2008
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
3 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 125 total points
ID: 21778737
>>How do you configure the PIX so that I can telnet into it from the main office LAN

Dont do it that way - use SSH its quicker easier and more secure

Allow SSH to PIX / ASA

First allow an IP address (Or network)

eg

ciscoasa(config)#ssh 217.22.146.123 255.255.255.255 outside

or

ciscoasa(config)#ssh 217.22.146.0 255.255.255.0 outside

or

ciscoasa(config)#ssh 192.168.1.1 255.255.255.255 inside

or

ciscoasa(config)#ssh 192.168.1.0 255.255.255.0 inside


Then (Only do this once) Create an RSA key on the Firewall

ciscoasa(config)# crypto key generate rsa
INFO: The name for the keys will be: <Default-RSA-Key>
Keypair generation process begin. Please wait...
Ciscoasa(config)#

Load an SSH Client on your PC e.g. PuTTy http://www.putty.nl/

Under "HostName (or IP Address) enter the Firewalls details
Tick SSH
Select Open
Note: You can give the connection and Save it for use again.

The first time is connects it will give you a warning about
trusting the other end accept it.

The username is pix
The Password is the Firewalls telent password

Note: The telnet password is set to cisco by default change it
using the passwd command

ciscoasa(config)#passwd newpassword.

Note if there is a problem with the keys, they might have corrupted. To repair


On PIX (v6)

ca zeroize rsa
ca gen rsa key 1024
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 21778808
if the traffic is vpn protected you should be able to get telnet access down the tunnle if you have this command in the config

management-access inside
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 21802418
ThanQ
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question