Driver Support Document

Cisco firewalls, FWSM series, OS version 3.x & 4.x, PIX, ASA, & LocalDirector series, OS version 4.x, 5.x, 6.x, 7.x, 8.x, 9.x

• Internal Driver Name: CiscoPIX_JS
• Driver Package: CiscoPIX_JS.rdp
  
• Driver Tier: 3
• Vendor: Cisco
• Family: Cisco PIX
• IPv6 Support: Yes

Show Tested Devices Grid

Driver Features Support Grid

General Access

Release Notes

Virtual Device Context IP interface detection

Cisco ASA devices support creating contexts that can be independently addressable. When the NA Module Status diagnostic is run, the driver will detect virtual device contexts and log into to each context to determine its IP address. The first address reported for the external interface (default: "outside") will be recorded as the address by which the context can be reached. To change this default, set the device access variable "extinterface" to the name of the interface that contains the IP address desired to reach the context. To disable IP parsing for context management, set the "extinterface" variable to "false".

Disabling context management

The context management feature adds independent device entries for contexts on the device automatically by using the inventory diagnostic. This feature can be disabled by adding the access variable "disable_context" and setting it to true. Disabling the feature will remove any previously created context devices permanently and will result in the inability to directly manage contexts with NA. Changes will take effect the next time the NA Module Status diagnostic task is run.

Disable tagging of Primary and Secondary devices

By default, the tag "active" or "secondary" is added to the hostname field to indicate the presence of a failover system, because this could cause the hostnames to be set to the same value. This would interfere with the management of the device's virtual contexts. To disable this alteration, set the "keep_hostname" access variable to "true", which will cause the hostname to be left unaltered.

return to top

Retrieve Running Configuration

Release Notes

TFTP interface setting

PIX devices self-select the interface to use for TFTP transfers. To override the device's selection, set the device access variable TFTPInterface to contain the name of the desired interface.

Full backup of WebVPN and TrustPoint information

ASA devices contain several extra items of configuration that are not part of the running config. Collection of the various WebVPN objects can be enabled by setting the Device Access variable "FullASABackup" to true. TrustPoint certificates can also be exported to the store configuration by also setting the "BackupTrusts" variable to true; this requires FullASABackup to also be set. Certificate information is not masked in the configuration, so these data portions are made specifically to be opt-in only; security risks by exposure of the information is the responsibility of the user.

Device defines multiple Serial Numbers

Some PIX/ASA devices are known to show "the" serial number only in the 'show inventory' command [under the Chassis item], and list a separate serial number in 'show version' that is used only for licensing. The serial from 'show inventory' is parsed by default, but if the device access variable "use_version_serial" is set, the serial from 'show version' will be parsed instead.

return to top

Configuration Deployment to Running

Release Notes

Deployment of masked configurations

CLI snapshot of PIX and ASA devices can result in a configuration containing masked private date, including passwords, community strings, and varous keys. Deploying such a configuration to the device can be dangerous, and may result in a non-functioning device. To preserve device connectivity, the configuration deployment task will automatically fail when presented with a masked configuration. To override this protection, set the Device Access variable "override_deploy" to "true".

Double-check deployed configurations

The PIX occasionally has difficulty merging new configuration commands with the existing configuration. Because of this, double-checking the results of a configuration deployment task is recommended. Note that some settings from the deployment may be applied, even though the deployment task failed.

return to top

Syslog Configuration and Change Detection

Release Notes

Syslog interface must be defined

Cisco Firewalls require the specification of the interface to be used for relaying of syslog messages. The custom access variable "SyslogInterface" should be set to the correct interface to ensure correct operation of Syslog tasks.

return to top

Password Management

Release Notes

Changing limited password

It the Limited Access Password field is deployed without a password, it will deploy the telnet console access password, using the passwd command on the device.

return to top

ACL Parsing

Release Notes

Conduit ACL deletion

Conduits cannot be deleted because they require "line by line" removal. They should be removed by normal command script methods.

return to top

Driver Discovery

Release Notes

More prompt causes an unexpected disconnection

Discovery tasks for Javascript drivers handle More prompts by using timeouts, which can cause problems with the third-party SSH client code, which interprets the timeout as a disconnection. There are two options to work around the problem. Setting the RCX option [<option name="Driver/Discovery/UsePollRead">true</option>] in site_options.rcx will effect the workaround for all affected devices. Alternatively, it could be applied to a single device by setting the device access variable "PollRead" to "true".

Wakeup Ctrl-U character can cause discovery to fail

Discovery tasks for Javascript drivers use wakeup characters are sent during device connection, to ensure that the device is responding. Normally, these characters do not echo to the console, but some devices may echo them. In this case, this causes the prompt detection phase to fail, which in turn can cause More prompts to not be handled properly, and discovery may fail. If these characters are echoed from the device [check the session log to see this], then set the device access variable "skip_ctrl_u" to skip the sending of the wakeup characters. Note that setting this option on a previously working device could cause discovery tasks to fail, but it only affects CLI discovery. SNMP discovery is unaffected.

return to top

Syslog Triggering

Trigger Patterns

Devices supported by this driver trigger changes using the following patterns:
(?:PIX|ASA|FWSM)-5-111005
(?:PIX|ASA)-5-111007
(?:PIX|ASA)-5-111008
(?:PIX|ASA)-5-199001
(?:PIX|ASA)-5-611103
FWSM-6-605005


User Patterns

These patterns are used to determine the username/IP responsible for a change:
/(?:ASA/
/FWSM/
/PIX)\S+: Login permitted from.* for user "(\S+)"/
/(?:ASA/
/FWSM/
/PIX)\S+: User \'(\S+)\' executed the \'enable\' command/
/(?:ASA/
/FWSM/
/PIX)\S+: User \'(\S+)\' executed the \'write memory' command/
/(?:ASA/
/FWSM/
/PIX)\S+: User logged out: Uname: (\S+)/
/(?:ASA/
/FWSM/
/PIX)\S+: Begin configuration: (\S+) reading/
/(?:ASA/
/FWSM/
/PIX)\S+: (\S+) end/

return to top