Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 519)

100

101

32-11

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 32 Monitoring and Troubleshooting

Troubleshooting the Security Appliance

Cisco PIX password tool (4.0) #0: Tue Aug 22 23:22:19 PDT 2005

Flash=i28F640J5 @ 0x300

BIOS Flash=AT29C257 @ 0xd8000

Do you wish to erase the passwords? [yn] y

Passwords have been erased.

Rebooting....

Disabling Password Recovery

You might want to disable password recovery to ensure that unauthorized users cannot use the password

recovery mechanism to compromise the security appliance. To disable password recovery, enter the

following command:

hostname(config)# no service password-recovery

On the PIX 500 series security appliance, the no service password-recovery command forces the PIX

password tool to prompt the user to erase all Flash file systems. The user cannot use the PIX password

tool without first performing this erasure. If a user chooses not to erase the Flash file system, the security

appliance reloads. Because password recovery depends on maintaining the existing configuration, this

erasure prevents you from recovering a password. However, disabling password recovery prevents

unauthorized users from viewing the configuration or inserting different passwords. In this case, to

recover the system to an operating state, load a new image and a backup configuration file, if available.

Other Troubleshooting Tools

The security appliance provides other troubleshooting tools to be used in conjunction with Cisco TAC:

• Viewing Debug Messages, page 32-11

• Capturing Packets, page 32-11

• Viewing the Crash Dump, page 32-12

Viewing Debug Messages

Because debugging output is assigned high priority in the CPU process, it can render the system

unusable. For this reason, use debug commands only to troubleshoot specific problems or during

troubleshooting sessions with Cisco TAC. Moreover, it is best to use debug commands during periods

of lower network traffic and fewer users. Debugging during these periods decreases the likelihood that

increased debug command processing overhead will affect system use. To enable debug messages, see

the debug commands in the Cisco Security Appliance Command Reference.

Capturing Packets

Capturing packets is sometimes useful when troubleshooting connectivity problems or monitoring

suspicious activity. We recommend contacting Cisco TAC if you want to use the packet capture feature.

See the capture command in the Cisco Security Appliance Command Reference.

1 2 ... 514 515 516 517 518 519 520 521 522 523 524 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 519

Komentarze do niniejszej Instrukcji