Cisco PIX 515E
The Cisco PIX 515E Firewall was designed for small- to medium-size businesses. The PIX 515E is the smallest firewall of the PIX family that is designed to be rack-mountable and is a standard 1U (1.75-inch) configuration. It has a 433-MHz processor, 32 MB or 64 MB of RAM, and 16 MB of Flash memory. It has two fixed 10/100 Ethernet interfaces that have a default configuration of outside (Ethernet 0) and inside (Ethernet 1) and contains two PCI slots for the installation of up to four additional Ethernet interfaces.
The PIX 515E also supports the use of virtual interfaces for switched environments using 802.1q VLAN tagging. It has a 9600-baud console port that is used for local device management. The PIX 515E can be configured for failover using a failover cable connected to the 115-kbps serial connection. PIX Firewall OS version 6.2 provides the functionality for long-distance (LAN-based) failover. This is discussed in greater detail in Chapter 11, "Routing and the Cisco Security Appliance."
Connection capabilities for the PIX 515E are as follows:
■ Maximum clear-text throughput—188 Mbps
■ Maximum throughput (3DES)—63 Mbps with VAC
■ Maximum throughput (3DES)—140 Mbps with VAC+
■ Maximum throughput (AES-128)—135 Mbps with VAC+
■ Maximum throughput (AES-256)—140 Mbps with VAC+
■ Maximum concurrent connections—130,000
■ Maximum concurrent VPN peers—2000
As shown in Figure 3-7, the PIX 515E has three status LEDs on the front panel that indicate power to the system, that the system is active (the OS is fully loaded and the system is operational), and that there is network activity on any interface. If you have two firewalls running in the failover mode, the active light indicates which firewall is active and which is standby.
Figure 3-7 PIX 515E Front Panel
The rear of the PIX 515E contains the Ethernet ports and the console port. The PIX 515E can handle up to four additional Ethernet interfaces. This could be a single four-port Ethernet card (see Figure 3-8) or two single-port cards (see Figure 3-9). The PIX 515E automatically recognizes and numbers any additional interfaces that are installed.
The PIX 515E also can be configured with a VAC or VAC+. The VAC and VAC+ handle much of the VPN traffic processing (encryption and decryption), thus improving the firewall's performance. The VAC and VAC+ are recommended for firewalls that connect multiple high-traffic VPNs.
Figure 3-8 PIX 515E with Additional Four-Port Interface
Figure 3-8 PIX 515E with Additional Four-Port Interface
Ethernet 5
- Figure 3-9 PIX 515E with Two Additional Interfaces
The installation of additional interfaces and failover requires that the software license be upgraded from the basic license (515-R) to the unrestricted license (515-UR). A maximum of three interfaces can be installed using the restricted license.
The console connection for the PIX 515E is the same as for the 506E.
There are three licenses available for the PIX 515E Firewall. Upgrades are available to implement VPN support. Table 3-4 describes the available licenses and their functions.
|
License |
Function |
|
Restricted Software License |
Support for 32 MB of RAM and up to three 10/100 interfaces. The restricted license supports only limited VPN connectivity and does not support failover. |
|
Unrestricted Software License |
Support for 64 MB of RAM, up to six 10/100 interfaces, stateful failover, integrated VAC or VAC+, and 5 security contexts. |
|
Failover Software License |
Support for a "hot standby" system designed to operate in conjunction with an active system running the unrestricted license. |
Continue reading here: Cisco PIX 525
Was this article helpful?