[Last Call] Learn how to a build a cloud-first strategyRegister Now


Cisco Pix Firewall - Recover VPN Password?

Posted on 2009-12-21
Medium Priority
Last Modified: 2012-08-13
We have a CISCO PIX Firewall - one of our client that connected to us through a VPN accidentally deleted all his settings, like host name, username, password, etc in his CISCO VPN Client Version 4.8. Is there any way I can see from the firewall somehow his username/password/hostname, etc? Thank you!
Question by:Cubbybulin
LVL 43

Expert Comment

ID: 26098257
You can see the group name and password by using the more system:running-config command.  You can't see the actual users username and password, just the VPN group and password.  The host will be the IP address of the outside interface or whatever DNS names resolves to that.
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 26098263

Please show is the config an I tell you whinch line cotains that you need...

If you want to know the hidden passwords do the following:

more system1:run
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 26098281
sorry this line that you need:
vpn# more system:running-config
 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.


Author Comment

ID: 26098352
sorry but I have the following:

then i enter vpn# more system:running-config
and it says Type help or '?' for a list of available commands.
how do i get to vpn#
LVL 16

Expert Comment

ID: 26098914
same as you used in enable mode of your PIX...

but try
#more ?
.. what hints you get ??

you must get: system if so then ? you will get running-config

if not send sh version results

LVL 34

Expert Comment

by:Istvan Kalmar
ID: 26098944
if it is older version which not knows more command please copy startup-config to tftp server:

copy startup tftp

Author Comment

ID: 26099078
Ok I think the problem is that i know nothing about firewalls - so can you tell me step by step what to do. For enable mode I used
pixfirewall> enable
What is my next step?

Author Comment

ID: 26099099
its a pix 501
LVL 17

Expert Comment

ID: 26099389


show running-config
LVL 34

Accepted Solution

Istvan Kalmar earned 2000 total points
ID: 26102488
show running config never show the password in clear-text....

Please refer this guide howto copy the config....:


Author Comment

ID: 26105543
Ok, here is the running config - and i was able to see the password on the tftp server. Just to make sure, in the cisco vpn client these will be my settings:

Host: xxxxxxx.org
Group Name: jaremotes
password: *********

and it should work right? - I see something about crypto map to Dayton Client - which is where this person is located. Does this means only he can connect with vpn to use or I can try these settings from my home? Thanks!

PIX Version 6.3(5)
interface ethernet0 10baset
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password GWrHuOdSnP3vVpxD encrypted
passwd GWrHuOdSnP3vVpxD encrypted
hostname pixfirewall
domain-name xxxxxxx.org
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
access-list aclin permit tcp any host xx.x.xx.xxx eq 4899
access-list aclin permit tcp any host xx.x.xx.xxx eq smtp
access-list aclin permit tcp any host xx.x.xx.xxx eq www
access-list aclin permit tcp any host xx.x.xx.xxx eq citrix-ica
access-list aclin permit tcp host xx.x.xx.xxx host xx.x.xx.xxx eq ldap
access-list aclin permit tcp any host xx.x.xx.xxx eq 3389
access-list vpn_nat_acl permit ip 255.255
access-list outside_cryptomap_dyn_20 permit ip any
access-list jaremotes_splitTunnelAcl permit ip any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside xx.x.xx.xxx
ip address inside
ip audit info action alarm
ip audit attack action alarm
ip local pool RemoteVPNPool
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list vpn_nat_acl
static (inside,outside) xx.x.xx.xxx netmask 0 0
static (inside,outside) xx.x.xx.xxx netmask 0 0
static (inside,outside) xx.x.xx.xxx netmask 0 0
access-group aclin in interface outside
route outside xx.x.xx.xxx 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http inside
http inside
no snmp-server location
no snmp-server contact
snmp-server community public
floodguard enable
sysopt connection permit-ipsec
sysopt noproxyarp inside
crypto ipsec transform-set strong esp-des esp-md5-hmac
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_dyn_20
crypto dynamic-map outside_dyn_map 20 set transform-set strong
crypto map toDayton 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map toDayton client configuration address initiate
crypto map toDayton client configuration address respond
crypto map toDayton interface outside
isakmp enable outside
isakmp key ******** address netmask
isakmp client configuration address-pool local RemoteVPNPool outside
isakmp nat-traversal 20
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
isakmp policy 15 authentication pre-share
isakmp policy 15 encryption des
isakmp policy 15 hash md5
isakmp policy 15 group 2
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 1
isakmp policy 10 lifetime 86400
isakmp policy 15 authentication pre-share
isakmp policy 15 encryption des
isakmp policy 15 hash md5
isakmp policy 15 group 2
isakmp policy 15 lifetime 86400
vpngroup jaremotes address-pool RemoteVPNPool
vpngroup jaremotes dns-server
vpngroup jaremotes default-domain xxxxxxxx.org
vpngroup jaremotes split-tunnel jaremotes_splitTunnelAcl
vpngroup jaremotes idle-time 7200
vpngroup jaremotes password ********
telnet inside
telnet timeout 5
ssh xx.xx.x.x outside
ssh timeout 5
console timeout 0
terminal width 80
: end

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question