PIX 501 - prefix-list causes PDM to fail

Question

Hi
I am configuring a redundant link via ADSL between 2 501 routers
I cant get the link to activate when the system is connected to the local network because it picks up a OSPF route to the remote site via the main internal network.
I tried to ad a filter to prevent the the route being recieved. And here is my problem
Either using PDM or the command line, the creation of a filter
prefix-list mel-backup seq 9 deny melbackup/30 causes the PDM to lock on startup or save.
And the area filter command seems to have no effect
I even tried a random internal route.
The commands I am adding are
prefix-list backup_melb seq 3 deny Level9/24
router ospf 22
network 10.150.102.22 255.255.255.255 area 0
area 0 filter-list prefix backup_melb in
Does anyone know of a problem with this ?
Thanks in Advance
Mark Casey

Answer 1

Hi,
PIX501 is a very very old Cisco firewall that has not been sold for a long time to my understanding. It also doesnt support even close to new software levels.
If you wanted to replace the PIX501 the corresponding model nowadays would be ASA5505 which is the smallest Cisco ASA firewall with 8 switch port module. There is already a new ASA5500-X Series (while ASA5505 is of the original ASA 5500 Series) but they have not yet introduced a replacing model for this model nor have they stopped selling this unit. I have a couple of them at home. Though naturally they are more expensive than your usual consumer firewalls.
But if you wanted to replace your PIX firewall then I would probably suggest ASA5505. Naturally you could get some other models too but the cost naturally rises even more. I am not sure at what price these are sold as used.
I used some PIX501 firewalls at the start of my career but have not used them in ages since ASA5505 is pretty much the firewall model we use when we need a firewall/vpn device for a smaller network/branch site.
Here is a PDF of the original ASA5500 Series.
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/prod_brochure0900aecd80285492.pdf
Here is a PDF of the new ASA5500-X Series
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/at_a_glance_c45-701635.pdf
I am afraid that its very hard for me atleast to troubleshoot this especially since I have not seen any outputs yet. Also the very old CLI and lack of GUI (?) make it harder to see what the problem is.
Could you provide the requested outputs?
From the PIX after connection test
show crypto ipsec sa
Screen captures of the VPN Client routing and statistics sections.
- Jouni