Question about older PIX / is the seller lying/misinforming to me?

Hey all, I was the high bidder on a PIX firewall today (not on
eBay...you have to register on the site to view closed auctions so
it's not worth the effort of providing a link), and I've been doing
some additional research this evening and I'm thinking I'm being
misinformed/taken for a ride here. I'm going to admit that I know
next to nothing about the PIX-I'm a college student who purchased it
just to learn about it by playing with it. I don't want to make
accusations without the opinions of someone who knows more about them.
Here's what I know about the PIX. First he said it was an early
version of the 535. Later on the seller said it was the 535's
predecessor. The part number is 47-3158-0.
From the pictures I can see the unit's in a rackmount case-it looks
like it's 4U tall. It has a hinged door on the front and has a floppy
drive behind it.
The seller posted the following description
---START---
The world-leading Cisco PIX 500 Series Firewalls are purpose-built
security appliances that deliver unprecedented levels of security,
performance and reliability. These platforms provide robust,
enterprise-class security services including stateful inspection
firewalling, standards-based IPsec Virtual Private Networking (VPN),
intrusion protection and much more in cost-effecective, easy to deploy
solutions. Ranging from compact, plug-n-play desktop firewalls for
small/home offices to carrier class gigabit firewalls for the most
demanding enterprise and service provider environments, The PIX
Firewall is intended for large Enterprise and Service Provider
environments, provides over 1 Gbps of firewall throughput with the
ability to handle up to 500,000 concurrent connections. Built upon a
hardened, purpose-built operating system for security services, PIX
OS, PIX Firewalls provide the highest levels of security and have
earned many industry accolades including ICSA Firewall and IPsec
certification as well as Common Criteria EAL4 evaluation status. PIX
Firewalls provide a wide range of security and networking services
including Network Address Translation (NAT), Port Address Translation
(PAT), content filtering (Java/ActiveX), URL filtering, AAA
(RADIUS/TACACS+) integration, support for leading X.509 PKI solutions,
DHCP client/server, PPPoE support (coming in Q1 2002) and much more.
PIX Firewalls also provide advanced security services for multimedia
applications and protocols including Voice over IP (VoIP), H.323, SIP,
Skinny and Microsoft NetMeeting, giving you the peace of mind when
deploying next generation converged network services. Administrators
can choose from a wide variety of solutions for remotely configuring,
monitoring and troubleshooting PIX firewalls. These solutions range
from an integrated, Web-based management interface (PIX Device
Manager) to centralized, policy-based management tools to support for
remote monitoring protocols such as Simple Network Management Protocol
(SNMP) and syslog. Administrators can also manage PIX firewalls using
a convenient command-line interface (CLI) through a variety of methods
including Telnet, Secure Shell (SSH) and an out-of-band console port.
---END---
Now, I've been doing some research, and the pictures look more like a
PIX Classic/10000 (Are these the same/what's different?)
Poking around on Cisco's site, I find that there's very little
information (virtually none) on this unit. From what I've been able
to scrounge from the net, it seems like this unit can only handle
about 90 mbits/second of traffic...a far cry from the 1gbit/sec the
add claimed. I'm just getting concerned-can this unit do at least the
majority of the things listed in the auction, or have I been scammed?

Thanks,
Eric Kotz

 

Chrix,

Yeah, you were taken for a ride. It might be a 520, or the older 10000. If
he said it was a 535 in his auction, he's an outright liar. And if it's the
10000, it won't run the latest and greatest of PIX software. I would
recommend that you buy a new or used 501. A used 501, if you are patient,
can be bought for about 300-350 on ebay.

I'm curious as to what the winning bid was for this auction, if you wouldn't
mind sharing this.

Hope this helps!

Cheers!
--

Richard A. Deal

Visit my home page at http://home.cfl.rr.com/dealgroup/

Author of CCNA Cisco Certified Network Associate Study Guide (Exam 640-801),
Cisco PIX Firewalls, CCNA Secrets Revealed!, CCNP Remote Access Exam Prep,
CCNP Switching Exam Cram, and CCNP Cisco LAN Switch Configuration Exam Cram

Cisco Test Prep author for QuizWare, providing the most comprehensive Cisco
exams on the market.

 

:Hey all, I was the high bidder on a PIX firewall today

:I'm thinking I'm being
:misinformed/taken for a ride here.

:Here's what I know about the PIX. First he said it was an early
:version of the 535. Later on the seller said it was the 535's
redecessor. The part number is 47-3158-0.

Cisco doesn't use numeric part numbers for any PIX model.

:From the pictures I can see the unit's in a rackmount case-it looks
:like it's 4U tall. It has a hinged door on the front and has a floppy
:drive behind it.

That's an original PIX, now known as the "PIX Firewall Classic".
Look carefully at the installation diagrams in this reference,
and notice that only the original PIX had the swing-down door:

http://www.cisco.com/en/US/products...stallation_guide_chapter09186a0080089c8a.html

By the time of the PIX 10000, the hinged door was gone and the floppy
migrated further to the right. By the time of the first 500 series,
the devices were no longer as tall.


:The seller posted the following description
:---START---
:The world-leading Cisco PIX 500 Series Firewalls are purpose-built
:security appliances that deliver unprecedented levels of security,
erformance and reliability.

They are, but it's not a PIX 500 series!


:The PIX
:Firewall is intended for large Enterprise and Service Provider
:environments, provides over 1 Gbps of firewall throughput with the
:ability to handle up to 500,000 concurrent connections.

The seller is quoting current product literature representing the
maximum capacity of the series. The 535 is the only (stand-alone)
member of the line able to provide over 1 Gbps.


:Administrators can also manage PIX firewalls using
:a convenient command-line interface (CLI) through a variety of methods
:including Telnet, Secure Shell (SSH) and an out-of-band console port.

The first version that supported ssh was 5.2(1), which required
16 Mb of flash and 32 Mb of RAM. As best I can gather, many of the
PIX Classic were left somewhere around 4.2 release (more memory
was required after 4.2(5)), and it wouldn't surprise me if the
unit you bid on was down around 4.2(2).


:From what I've been able
:to scrounge from the net, it seems like this unit can only handle
:about 90 mbits/second of traffic...a far cry from the 1gbit/sec the
:add claimed.

45 Mbps for the PIX Classic.


:I'm just getting concerned-can this unit do at least the
:majority of the things listed in the auction, or have I been scammed?


Was there anything else in the actual ad, other than quoting the
Cisco sales literature? Because what it sounds like at the moment
is akin to attaching a description of a modern Porche to a sale of
an original Volkswagen Beatle -- the description itself isn't -wrong-,
it just doesn't apply!

Based on the ad, you have a right to expect at least something
in the 500 series range, the oldest of which appears to be the 515
when I look at the technical documentation. [Odd, I had always
thought the 510 was before the 515.] The tall unit you describe
is not in the 500 series.

 

:Yeah, you were taken for a ride. It might be a 520, or the older 10000.

If you look at the install guides,
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v52/install/openbox.htm#41235
the 520 and 10000 did not have the hinged door -- only the original PIX
("PIX Classic") did.

 

Thanks for your response. Here's a link to the auction, if anyone has
a Yahoo account I think you can access it:
http://page.auctions.shopping.yahoo.com/auction/82090734?aucview=0x70
The auction closed for $209 plus $50 shipping. I know that's a lot
less than a 535 would fetch on eBay-but that didn't even make me
blink, as I've picked up stuff for 1/10 it's eBay value there (yahoo
auctions) before (Gigabit ethernet switch for $30 for instance)
Did I still buy the unit for a reasonable price? Are there any
hardware upgrades that can be done to make it capable of running
current software (I understand it's just a PC-I think a Pentium 133 in
the unit I bought) Or did I just spend $250 on a paperweight for
really big sheets of paper??
Can anyone offer some insite as to how inaccurate the description
is-is it even remotely correct, or should I be telling this guy I want
my money back (I don't have the unit yet) Is it remotely similar to
the 535?

Thanks,
Eric Kotz

 

:Here's a link to the auction

:http://page.auctions.shopping.yahoo.com/auction/82090734?aucview=0x70

Ah, I can't access that one.

:Are there any
:hardware upgrades that can be done to make it capable of running
:current software (I understand it's just a PC-I think a Pentium 133 in
:the unit I bought)

If it is the PIX Classic that I suspect, then 5.3(5) is the last
version it can run, but it can be a nuisance to get it up to that
level. Going past somewhere around 4.4 requires a new software key,
and Cisco isn't going to give you that key for free, as PIX software
is not transferable.

To run anything past 4.2(5) requires more memory than the original
PIX were sold with, but you should be able to get the memory for
less than $US100 or so.


: Or did I just spend $250 on a paperweight for
:really big sheets of paper??

:Can anyone offer some insite as to how inaccurate the description
:is-is it even remotely correct, or should I be telling this guy I want
:my money back (I don't have the unit yet) Is it remotely similar to
:the 535?

We'd need to know the true model, and the true version of
software installed.

If you can get it up to around PIX software level 5.2(3) or beyond,
then you can do some useful things with it. All of the PIX models
run the same software image (but not all commands are available
on all of them.) It's not going to be a fast unit, but by 5.2
most of the essential features were in place.

On the other hand, as the software isn't transferable, and the original
cost of those units was amazingly high, you will have a hard time
getting any newer software release for a reasonable cost. If your
purpose is to learn about modern PIXes, my personal evaluation is that
the 4.x software series would be a waste of time to start learning on,
with all of the key features having mutated drastically since the time
of 4.x. With a PIX 501 costing less than $US400, if the unit you
bid on does not have modern software, I'd say you'd be better off
refusing it and going for a 501.

 

The unit does appear to be a pix classic-it looks like the classic in
the illustrations that were posted.
The seller indicated it was running IOS 2.1x, (That number sounds too
low, but I'm not terribly familiar with IOS...maybe PIX OS 2.1x?) and
also indicated it was the early edition of the 535 enterprise PIX.
I guess it sounds like I've gotten taken for a ride here. Right now
the seller has my money, but has not yet shipped it. What are some
intelligent things I can say/ask the seller-should I let him ship it
and see if it can do what he claims in the add, and then deal with it
as necessary, or is the concensus that the add outright lies and I
should see if he's willing to refund my money and just cancle the
whole transaction. I guess I'm looking for any thoughts/suggestions
here.

Thanks,
Eric Kotz

 

A while ago, I went through the motions of upgrading a 520 to have
enough memory to run current code - I never actually did though
because it was cheaper and smarter to buy the newer 515.

Depends on your discount level..but still...it was cheaper to buy the
new one.

 

:The unit does appear to be a pix classic-it looks like the classic in
:the illustrations that were posted.
:The seller indicated it was running IOS 2.1x, (That number sounds too
:low, but I'm not terribly familiar with IOS...maybe PIX OS 2.1x?) and

Oh my.

If it is PIX 2.1, then it might not even have the Cisco brand name
on it. The oldest online documentation that Cisco has is for PIX 2.7.14.
They bought the product line as I recall. There isn't anywhere on
the net that appears to have documentation for PIX 2.6 or earlier.

If it is really PIX 2.1, then it is a museum piece. Seriously.


:also indicated it was the early edition of the 535 enterprise PIX.

Yeah, right, in about the same sense that a genuine IBM PC running
DOS 2 is an "early edition" of a modern Windows XP machine.


:I guess it sounds like I've gotten taken for a ride here. Right now
:the seller has my money, but has not yet shipped it.

If you used a credit card, tell the seller that he massively represented
the unit, and prepare to dispute the charges through your credit card
company.


:What are some
:intelligent things I can say/ask the seller-should I let him ship it
:and see if it can do what he claims in the add, and then deal with it
:as necessary, or is the concensus that the add outright lies and I
:should see if he's willing to refund my money and just cancle the
:whole transaction.

The PIX 2.x software is only vaguely close to the current 6.x software.
Almost no commands are the same.

You will have to decide to either accept it *as* a museum piece,
or to tell the seller that it was substantially misrepresented and
you want to cancel. Your chances of getting your money back after
you have the unit in your hand are small.

If it is as old as it sounds, someone on the group might be willing
to pay that $US209 for it to put in a collection.

 

:If it is PIX 2.1, then it might not even have the Cisco brand name
n it. The oldest online documentation that Cisco has is for PIX 2.7.14.
:They bought the product line as I recall.

Found a reference. The original company name was "Network Translation"
(NTI). One poster recalls that the original OS (now called 'Finesse')
might originally have been called "Phoenix", but I haven't confirmed that.

The press release about the purchase was:
http://www.cisco.com/warp/public/146/pressroom/1995/oct95/242.html

Interesting little article I found in google's cache of
triangle.bizjournals.com :

TBJ: MCNC's Center for Network Testing Services recently held a
"Switch-a-thon" to test the interoperability for IP switching across
a variety of platforms. A number of companies including IBM,
3Com Corp. and Digital Equipment Corp. were there. Why wasn't
Cisco Systems represented?

Meltzer: We weren't invited. Plus, IP switching is not the only
answer. We consider "Tag" switching to be a better technology than
IP switching. Tag switching is a multiprotocol approach, and
customers today have a large number of protocols in their system.
This technology is designed to take advantage of higher levels of
intelligence on the edge of the network.

TBJ: What, exactly, is "tag" switching?

Meltzer: Tag switching uses label-swapping techniques. When a
packet of information with a tag is received by a tag switch, the
switch uses the tag as an index in its Tag Information Base (TIB). If
the switch finds an entry with the incoming tag equal to the tag
carried in the packet, it replaces the tag in the packet with the
outgoing tag and forwards the packet. And while it does not rely on
ATM, it can be applied to ATM switches. We believe this is a
technology that will improve the scalability of IP networks.


Ohhhhh... and an even more interesting article:

http://groups.google.ca/groups?hl=en&lr=&ie=UTF-8&selm=

The first commerical NAT product, the Network Translation PIX Firewall
was written using Plan 9.

The author of that article was a co-founder of Network Translation. In
a later article, he claims that PIX was a pun on "P - IX" for Plan 9.
He talks more about the experience here:

http://groups.google.ca/groups?selm=

 

The ad claims " Cisco PIX 500 Series Firewalls...." and ".....for
multimedia applications and protocols including Voice over IP (VoIP),
H.323, SIP, Skinny and Microsoft NetMeeting, ...." and "....provides
over 1 Gbps of firewall throughput with the ability to handle up to
500,000 concurrent connections..."

neither of which are anywhere near the truth for that particular model.

I'd use that to get out of the deal. If the seller whines, you should be
able to go back to yahoo, as the hardware was clearly mis-represented.

--Mike

 

you bought a paperweight. why did you decide to do the reaserch now after
you sent your cash? get a pix 501 instead it will run 6.3.3

 

I wonder if anyone has any documentation on the original NTI boxes online or
OS 1.0

 

the 535 is the top of the line Pix box. intended for ISP or very large
companies. it doesn't have any floppy drives. I thought the only Pix in
the 500 series that had a floppy was the 520
Canadian pricing on a base model restricted 535 model is $12'325, or US
pricing would probably be 10 or 11k

the statement

Would only be a valid description for the 535. i could not find any
reference to the part number with my Cisco login either

Claude

--





*****to e-mail me directly remove NOSPAM in e-mail address*******

 

Actually, no 500 series PIX had the floppy.

MIke

 

520's did. I have 4 of them that could be booted from floppy.

--Mike

 

:Actually, no 500 series PIX had the floppy.

http://www.cisco.com/warp/public/110/upgrade.shtml

Creating a Bootable Diskette from Microsoft Windows

Note: The steps described below apply only to PIX devices that have
a floppy drive. Specifically, this group is limited to the PIX
Classic, 10000, 510 and 520.



For a summary of the differences between the various PIX models,
please see my list at
http://www.ibd.nrc.ca/~roberson/cisco_pix_models.txt

 

Yes, that's right they did. I was thinking of the lockable floppy.
They stopped that after the 10000.

Mike