PIX 520 Firewall HELP!!!

In article , BHAVESH PATEL wrote: :I need of some help :I have a PIX 520 firewall :basically I'm trying to get the ethernet interfaces to work

:The error I get is line is up protocol is down!! :any ideas why the protocol is down. :I am trying to connect this firewall to my cisco 3500 series switch and my :2600 series routers

"line is up protocol is down" sounds like a message from the switches, not from the PIX.

What the message means is that the line is physically fine, but that you have either have not configured IP on it, or else that you have IP disabled on it.

On the PIX, IP is disabled until you enter an 'interface' command; it is also disabled if you enter the 'shutdown' option for the interface command.

Hi Walter

here's one of my interfaces

it has the name inside and been given an ip address.... Cannot make sense of why the line is down????

Best Regards

Bhavesh

interface ethernet1 "inside" is up, line protocol is down Hardware is i82559 ethernet, address is 0090.27a7.25c8 IP address 10.1.1.200, subnet mask 255.255.255.0 MTU 1500 bytes, BW 10000 Kbit half duplex 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 8 packets output, 480 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 8 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (128/128) software (0/0) output queue (curr/max blocks): hardware (0/1) software (0/1)

Also

here is my running config

PIX Version 6.3(4)

interface ethernet0 100full

interface ethernet1 auto

interface ethernet2 100full

interface ethernet3 100basetx

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 dmz security50

nameif ethernet3 intf3 security6

enable password 2KFQnbNIdI.2KYOU encrypted

passwd AlCg2UlrFR71hEMW encrypted

hostname pix1

fixup protocol dns maximum-length 512

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol tftp 69

names

pager lines 24

mtu outside 1500

mtu inside 1500

mtu dmz 1500

mtu intf3 1500

no ip address outside

no ip address inside

ip address dmz 192.168.1.254 255.255.255.0

no ip address intf3

ip audit info action alarm

ip audit attack action alarm

no failover

failover timeout 0:00:00

failover poll 15

no failover ip address outside

no failover ip address inside

no failover ip address dmz

no failover ip address intf3

pdm history enable

arp timeout 14400

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server TACACS+ max-failed-attempts 3

aaa-server TACACS+ deadtime 10

aaa-server RADIUS protocol radius

aaa-server RADIUS max-failed-attempts 3

aaa-server RADIUS deadtime 10

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80

Cryptochecksum:bd58d4b1fc07fa93ec0510c3af6d1e0e

: end

Hi Bhavesh,

I am not too familiar with the PIX, but on other Cisco hardware "Line UP protocol DOWN" means that the PIX interface is configured to be ACTIVE, but the physical interface is not seeing a connection to anywhere. On an Ethernet interface on a Switch or Router this would most likely mean that the cable on that port is not plugged into anything, possibly because a Crossover cable is needed instead of a straight-through cable. On a WAN interface it could also mean that the WAN type is not configured correctly (EG: line encoding).

From memory a PIX acts as a DTE device, the same as a Router, whereas a Switch is a DCE device. This means that the 3500 Switch to PIX link needs a straight through cable, and the PIX to 2600 Router link needs a Cross-over cable.

Cheers....................pk.

In article , BHAVESH PATEL wrote: :here is my running config

:PIX Version 6.3(4)

:no ip address inside

:> it has the name inside and been given an ip address.... :> Cannot make sense of why the line is down????

Look again: you have 'no ip address inside'. The only interface that has an IP address is your dmz interface.