PIX515升级IOS

PIX 535升级为PIX OS 7.01
1、先看这里有没有合适的：

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_70/pix_upgd/pixupgrd.htm

查看原来的版本，看内存等等是否符合升级要求，535-UR要1G内存才能升级。

pixfirewall# sh ver

Cisco PIX Firewall Version 6.3(4)
Cisco PIX Device Manager Version 3.0(1)

Compiled on Fri 02-Jul-04 00:07 by morlee

pixfirewall up 8 days 0 hours

Hardware: PIX-535, 1024 MB RAM, CPU Pentium III 1000 MHz
Flash i28F640J5 @ 0x300, 16MB
BIOS Flash DA28F320J5 @ 0xfffd8000, 128KB

Encryption hardware device : VAC+ (Crypto5823 revision 0x1)
0: gb-ethernet0: address is 000e.0c6b.96d0, irq 255
1: gb-ethernet1: address is 000e.0c6b.96cf, irq 255
2: ethernet0: address is 000e.0c5f.a3f0, irq 255
3: ethernet1: address is 000e.0c5f.a349, irq 255
Licensed Features:
Failover: Enabled
VPN-DES: Enabled
VPN-3DES-AES: Enabled
Maximum Physical Interfaces: 10
Maximum Interfaces: 24
Cut-through Proxy: Enabled
Guards: Enabled
URL-filtering: Enabled
Inside Hosts: Unlimited
Throughput: Unlimited
IKE peers: Unlimited

This PIX has an Unrestricted (UR) license.

Serial Number: XXXXXXXXX
Running Activation Key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Configuration last modified by enable_15 at 00:55:28.017 UTC Tue Jun 7 2005

2、检查一下flash能不能访问：
pixfirewall# sh flash
flash file system: version:3 magic:0x12345679
file 0: origin: 0 length:1966136
file 1: origin: 2097152 length:1975
file 2: origin: 0 length:0
file 3: origin: 2228224 length:3126944
file 4: origin: 0 length:0
file 5: origin: 8257536 length:308
3、检查原来的配置，保存之
pixfirewall# sh ru
4、检查一下PIX上的interface，查看其工作状态：
pixfirewall# sh int
interface gb-ethernet0 "outside" is up, line protocol is up
…………
interface gb-ethernet1 "inside" is up, line protocol is up
…………
interface ethernet0 "inf3" is administratively down, line protocol is up
…………
interface ethernet1 "inf4" is administratively down, line protocol is down
…………
5、我在这里先配了一个FE口测试与终端的连通性，以便确保等一阵可以用TFTP
pixfirewall(config)# ip address inf3 10.32.2.79 255.255.255.0
pixfirewall(config)# exit
pixfirewall#
pixfirewall# ping 10.32.2.78
10.32.2.78 response received -- 0ms
10.32.2.78 response received -- 0ms
10.32.2.78 response received -- 0ms

6、好了，重启PIX，准备升级。
这是启动的画面，比较多字符。
按esc中断FLASH引导，进入monitor模式下。

Wait.....

PCI Device Table.
Bus Dev Func VendID DevID Class Irq
00 00 00 1166 0008 Host Bridge
00 00 01 1166 0008 Host Bridge
00 00 02 1166 0006 Host Bridge
00 00 03 1166 0006 Host Bridge
00 01 00 8086 1229 Ethernet 255
00 02 00 8086 1229 Ethernet 255
00 0F 00 1166 0200 ISA Bridge
00 0F 01 1166 0211 IDE Controller
00 0F 02 1166 0220 Serial Bus 71
01 0B 00 14E4 5823 Co-Processor 255
02 06 00 8086 1001 Ethernet 255
02 07 00 8086 1001 Ethernet 255

Cisco Secure PIX Firewall Embedded BIOS Version 4.3
Cisco PIX-535
+------------------------------------------------------------------------------+
| System BIOS Configuration, (C) 2000 General Software, Inc. |
+---------------------------------------+--------------------------------------+
| System CPU : Pentium III | Low Memory : 637KB |
| Coprocessor : Enabled | Extended Memory : 1023MB |
| Embedded BIOS Date : 11/28/00 | Serial Ports 1-2 : 03F8 02F8 |
+---------------------------------------+--------------------------------------+

Cisco Secure PIX Firewall BIOS (4.2) #0: Mon Dec 31 08:34:34 PST 2001
Platform PIX-535
Flash=i28F640J5 @ 0x300

Use BREAK or ESC to interrupt flash boot.
Use SPACE to begin flash boot immediately.
Flash boot interrupted.
0: i8255X @ PCI(bus:0 dev:2 irq:255)
1: i8255X @ PCI(bus:0 dev:1 irq:255)

Ethernet auto negotiation timed out.
Ethernet port 1 could not be initialized.
Use ? for help.
monitor>
Invalid or incorrect command. Use 'help' for help.

7、查看在monitor下可用的interface，肯定就是那两个FE口了。
monitor> interface
0: i8255X @ PCI(bus:0 dev:2 irq:255)
1: i8255X @ PCI(bus:0 dev:1 irq:255)
8、这里我选用第一个fe口，就是刚才测试过的那个口
monitor> interface 0
0: i8255X @ PCI(bus:0 dev:2 irq:255)
1: i8255X @ PCI(bus:0 dev:1 irq:255)

Using 0: i82559 @ PCI(bus:0 dev:2 irq:255), MAC: 000e.0c5f.a3f0
9、配上接口地址，TFTP服务器地址等等，开始TFTP下载新版PIXOS。
monitor> address 10.32.2.79
address 10.32.2.79
monitor> server 10.32.2.78
server 10.32.2.78
monitor> ping 10.32.2.78
Sending 5, 100-byte 0x7970 ICMP Echoes to 10.32.2.78, timeout is 4 seconds:
!!!!!
Success rate is 100 percent (5/5)
monitor> file pix701.bin
file pix701.bin
monitor> tftp
tftp pix701.bin@10.32.2.78...........................
…………
Received 5124096 bytes
Cisco PIX Security Appliance admin loader (3.0) #0: Thu Mar 31 14:03:05 PST 2005
####################################################
……
1024MB RAM
10、下载完之后，PIX直接用新版PIXOS启动了。

Total NICs found: 4
mcwa i82559 Ethernet at irq 255 MAC: 000e.0c5f.a349
mcwa i82559 Ethernet at irq 255 MAC: 000e.0c5f.a3f0
BIOS Flash=DA28F320J5 @ 0xD8000
i82543 rev02 Gigabit Ethernet @ irq255 dev 6 index 01 MAC: 000e.0c6b.96cf
i82543 rev02 Gigabit Ethernet @ irq255 dev 7 index 00 MAC: 000e.0c6b.96d0
Old file system detected. Attempting to save data in flash

11、这里是检查整理一遍FLASH，并把原来的PIXOS映像存成image_old.bin
Initializing flashfs...
flashfs[7]: Checking block 0...block number was (-10627)
…………
flashfs[7]: erasing block 0...done.
flashfs[7]: Checking block 125...block number was (-1)
flashfs[7]: erasing block 125...done.
flashfs[7]: 0 files, 1 directories
flashfs[7]: 0 orphaned files, 0 orphaned directories
flashfs[7]: Total bytes: 16128000
flashfs[7]: Bytes used: 1024
flashfs[7]: Bytes available: 16126976
flashfs[7]: flashfs fsck took 161 seconds.
flashfs[7]: Initialization complete.

Saving the configuration
!
Saving a copy of old configuration as downgrade.cfg
!
Saved the activation key from the flash image
Saved the default firewall mode (single) to flash
The version of image file in flash is not bootable in the current version of
software.
Use the downgrade command first to boot older version of software.
The file is being saved as image_old.bin anyway.
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

……

Upgrade process complete
Need to burn loader....
Erasing sector 0...[OK]
Burning sector 0...[OK]

Licensed features for this platform:
Maximum Physical Interfaces : 14
Maximum VLANs : 200
Inside Hosts : Unlimited
Failover : Active/Active
VPN-DES : Enabled
VPN-3DES-AES : Enabled
Cut-through Proxy : Enabled
Guards : Enabled
URL Filtering : Enabled
Security Contexts : 2
GTP/GPRS : Disabled
VPN Peers : Unlimited

This platform has an Unrestricted (UR) license.

12、继续引导：

Encryption hardware device : VAC+ (Crypto5823 revision 0x1)
--------------------------------------------------------------------------
. .
| |
||| |||
.|| ||. .|| ||.
.:||| | |||:..:||| | |||:.
C i s c o S y s t e m s
--------------------------------------------------------------------------

Cisco PIX Security Appliance Software Version 7.0(1)

****************************** Warning *******************************
This product contains cryptographic features and is
subject to United States and local country laws
governing, import, export, transfer, and use.
Delivery of Cisco cryptographic products does not
imply third-party authority to import, export,
distribute, or use encryption. Importers, exporters,
distributors and users are responsible for compliance
with U.S. and local country laws. By using this
product you agree to comply with applicable laws and
regulations. If you are unable to comply with U.S.
and local laws, return the enclosed items immediately.

A summary of U.S. laws governing Cisco cryptographic
products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by
sending email to export@cisco.com.
******************************* Warning *******************************

Copyright (c) 1996-2005 by Cisco Systems, Inc.

Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

Cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706

ERROR: This command is no longer needed. The LOCAL user database is always enabled.
*** Output from config line 59, "aaa-server LOCAL protoco..."
ERROR: This command is no longer needed. The 'floodguard' feature is always enabled.
*** Output from config line 64, "floodguard enable"
13、转换一些配置
Cryptochecksum(unchanged): a24fcf17 7e777a56 ca8e0420 377bb244
INFO: converting 'fixup protocol dns maximum-length 512' to MPF commands
INFO: converting 'fixup protocol ftp 21' to MPF commands
INFO: converting 'fixup protocol h323_h225 1720' to MPF commands
INFO: converting 'fixup protocol h323_ras 1718-1719' to MPF commands
INFO: converting 'fixup protocol http 80' to MPF commands
INFO: converting 'fixup protocol netbios 137-138' to MPF commands
INFO: converting 'fixup protocol rsh 514' to MPF commands
INFO: converting 'fixup protocol rtsp 554' to MPF commands
INFO: converting 'fixup protocol sip 5060' to MPF commands
INFO: converting 'fixup protocol skinny 2000' to MPF commands
INFO: converting 'fixup protocol smtp 25' to MPF commands
INFO: converting 'fixup protocol sqlnet 1521' to MPF commands
INFO: converting 'fixup protocol sunrpc_udp 111' to MPF commands
INFO: converting 'fixup protocol tftp 69' to MPF commands
INFO: converting 'fixup protocol sip udp 5060' to MPF commands
INFO: converting 'fixup protocol xdmcp 177' to MPF commands
13、这里的warning说得很清楚，呵呵，不要以为启动成功就认为升级完成了，其实只完成一半。

************************************************************************
** **
** *** WARNING *** WARNING *** WARNING *** WARNING *** WARNING *** **
** **
** ----> Current image running from RAM only! <---- **
** **
** When the PIX was upgraded in Monitor mode the boot image was not **
** written to Flash. Please issue "copy tftp: flash:" to load and **
** save a bootable image to Flash. Failure to do so will result in **
** a boot loop the next time the PIX is reloaded. **
** **
************************************************************************
Type help or '?' for a list of available commands.
14、启动完成，看看有没有什么新变化
pixfirewall> en
Password:
pixfirewall# sh run
: Saved
:
PIX Version 7.0(1)
names
!
interface GigabitEthernet0
speed 1000
nameif intf2
security-level 4
no ip address
!
interface GigabitEthernet1
speed 1000
nameif intf3
security-level 6
no ip address
!
interface Ethernet0
shutdown
nameif outside
security-level 0
no ip address
!
interface Ethernet1
shutdown
nameif inside
security-level 100
no ip address

enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
ftp mode passive
pager lines 24
mtu intf2 1500
mtu intf3 1500
mtu outside 1500
mtu inside 1500
no failover
monitor-interface intf2
monitor-interface intf3
monitor-interface outside
monitor-interface inside
asdm history enable
arp timeout 14400
nat-control
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp
no sysopt connection permit-ipsec
telnet timeout 5
ssh timeout 5
ssh version 1
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect http
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
Cryptochecksum:a24fcf177e777a56ca8e0420377bb244
: end

15、配置上的变化已经从CISCO文档得知了，但亲眼看到是令人眼前一亮。
再来检查一下版本等等信息。
pixfirewall# sh ver

Cisco PIX Security Appliance Software Version 7.0(1)

Compiled on Thu 31-Mar-05 14:37 by builders
System image file is "Unknown, monitor mode tftp booted image"
Config file at boot was "startup-config"

pixfirewall up 21 secs

Hardware: PIX-535, 1024 MB RAM, CPU Pentium III 1000 MHz
Flash i28F640J5 @ 0x300, 16MB
BIOS Flash DA28F320J5 @ 0xfffd8000, 128KB

Encryption hardware device : VAC+ (Crypto5823 revision 0x1)
0: Ext: GigabitEthernet0 : media index 0: irq 255
1: Ext: GigabitEthernet1 : media index 1: irq 255
2: Ext: Ethernet0 : media index 0: irq 255
3: Ext: Ethernet1 : media index 1: irq 255

Licensed features for this platform:
Maximum Physical Interfaces : 14
Maximum VLANs : 200
Inside Hosts : Unlimited
Failover : Active/Active
VPN-DES : Enabled
VPN-3DES-AES : Enabled
Cut-through Proxy : Enabled
Guards : Enabled
URL Filtering : Enabled
Security Contexts : 2
GTP/GPRS : Disabled
VPN Peers : Unlimited

This platform has an Unrestricted (UR) license.

16、这下查看flash看得明白了。
pixfirewall# sh flash

Directory of flash:/

4 -rw- 1975 01:52:34 Jun 07 2005 downgrade.cfg
7 -rw- 1966136 01:53:02 Jun 07 2005 image_old.bin

16128000 bytes total (14154752 bytes free)
17、还有一件很重要的事：将新版PIX0S下载到FLASH里。
pixfirewall# conf t
pixfirewall(config)# int e0
pixfirewall(config-if)# ip add 10.32.2.79 255.255.255.0
pixfirewall(config-if)# no sh
pixfirewall(config-if)# end
pixfirewall# ping 10.32.2.78
Sending 5, 100-byte ICMP Echos to 10.32.2.78, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
pixfirewall# copy tftp flash

Address or name of remote host []? 10.32.2.78

Source filename []? pix701.bin

Destination filename [img]? pix701.bin

Accessing tftp://10.32.2.78/pix701.bin...!!!!!!!!!!>ftp://10.32.2.78/pix701.bin...!!!!!!!!!!
…………
Writing file flash:pix701.bin...
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
……
17、检查FLASH,改写BOOTVAR，存盘
pixfirewall# sh flash:

Directory of flash:/

4 -rw- 1975 01:52:34 Jun 07 2005 downgrade.cfg
7 -rw- 1966136 01:53:02 Jun 07 2005 image_old.bin
9 -rw- 5124096 01:56:59 Jun 07 2005 pix701.bin

16128000 bytes total (9030144 bytes free)
pixfirewall# conf t
pixfirewall(config)# boot system flash:pix701.bin
INFO: Converting flash:pix701.bin to flash:/pix701.bin
pixfirewall(config)# end
pixfirewall# wr
Building configuration...
Cryptochecksum: 2b4bf78b 4f0a95ed b8ef276f 6974c7d6

1852 bytes copied in 0.540 secs
[OK]

pixfirewall# sh bootvar

BOOT variable = flash:/pix701.bin
Current BOOT variable = flash:/pix701.bin
CONFIG_FILE variable =
Current CONFIG_FILE variable =

18、再重启一次，就大功告成。
pixfirewall# reload
Proceed with reload? [confirm]
pixfirewall#

***
*** --- START GRACEFUL SHUTDOWN ---
Shutting down isakmp
Shutting down File system

***
*** --- SHUTDOWN NOW ---

Rebooting....