Introduction What are some general tips for the best PFM performance? Where can I get documentation on the PFM? Why does PFM not install? It says I do not have permission to run the installer. Why does my NT system speaker beep continuously after the PFM install? I have installed PFM, but it does not run (I do not see the banner page). Why do I get the error message "Security violation in all five IP addresses in
firewall.html" after I click the configuration link from the banner page? The banner page comes up, and requests a username and password. What is this? Can
they be changed from the defaults? Is there a log file I can look at for troubleshooting PFM problems? Why does PFM have numerous error messages or not load the configuration after the
install? Does PFM run on Windows 2000? How do I change the PFM administrator (pixadmin) and user (pixuser) passwords from
the defaults (which are noted in the PFM release notes)? How can I download PFM and PDM? Can I use Excel 95, 98, or 2000? I cannot open the .dbf files required for offline reporting. Why can I not download the < day>.dbf files? I downloaded < day>.dbf, but report.xls contains no data. I can open report.xls, but Excel cannot find the .dbf files it needs to run. What is wrong? Can I have the password to access and modify the macros embedded in report.xls for
my own use? Related Information
Introduction
This document contains frequently asked questions (FAQ) about the Cisco PIX Firewall Manager (PFM).
Q. What are some general tips for the best PFM performance?
A
Try not to install PFM on a machine that runs Microsoft Internet Information Server
(IIS). The install works, but you must verify that PFM does not occupy any server
ports used by IIS.
If any error messages are displayed during the PFM install, capture them (press ALT
+ PrtScn (Print Screen), cut and paste to a .txt file, and save). Contact the Technical
Assistance Center (TAC) immediately. Do not attempt to proceed.
Verify that your Windows NT Service Pack (SP) is up-to-date. All Windows NT
SPs through SP5 work on all PFM versions, but the browser that installs the service
pack may not be supported. Check the PFM banner page to verify browser
compatibility, and download the appropriate supported version. You can download
these versions from the Netscape FTP site at:
Q. Where can I get documentation on the PFM?
A. There is no print manual for the PFM. Online help is provided on most PFM screens.
Release notes are provided for each revision; read them before beginning installation.
Q. Why does PFM not install? It says I do not have permission to run the
installer.
A. Possible reasons:
You might not be logged into the Windows NT machine locally (not the domain) as
"administrator". At times, users with administrative rights can successfully install the
product, but usually even users in the administrator group do not have enough rights
to install the product.
You might be attempting to install on a primary domain controller (PDC) or a backup
domain controller (BDC). PFM installation needs to create a local Security Access
Management (SAM) database for PFM access, which is usually not possible with
default PDC or BDC installations. Further, when the PFM process is configured for
logging, the machine is taxed. Generally, administrators do not want to task critical
network servers, such as PDCs or BDCs with additional services.
Q. Why does my NT system speaker beep continuously after the PFM
install?
A. The NT beeps indicates an application port conflict. Usually, a syslog application (Cisco
Works, PIX Firewall Syslog Server (PFSS) or a third-party application) is already listening
on UDP 514, or a Web server is already occupying the PFM default TCP port 8080. Complete
these steps to troubleshoot:
Uninstall PFM completely. Use Windows Explorer to remove the install directory.
Reboot the machine.
Log in to the machine locally (not the domain) as "administrator" (not someone with
admin rights).
Note: Do not run setup yet.
At the command prompt, type netstat -a | findstr # (where # is the port number) to
verify that TCP 8080 and UDP 514 are not listed.
If UDP is listed, uninstall the application that uses it. à
If TCP 8080 is listed, choose an available TCP Port. 8081 is usually okay. à
If you uninstall any applications, repeat steps 2-4.
Note: It is important to reboot.
Check for and repair any error messages in the event viewer. (For help with the error
messages, search for the error message at Microsoft Help and Support .)
Verify in Control Panel | Services that the server service is running.
Reinstall PFM.
Reboot the machine. You can log into the domain or whatever you want this time.
Q. I have installed PFM, but it does not run (I do not see the banner
page).
A. Possible reasons:
You might not be browsing to the correct address; it should be either
http://the_nt_ip_address:8080 or http://127.0.0.1:8080 (if you selected an alternate
port during installation, use that port's number). Do not attempt to run index.html, it
does not work.
Make sure your Windows NT IP Stack is not set to use DHCP. You must be assigned
a static address.
Make sure this static assigned Windows NT IP address has not changed after
installation of PFM.
Go to Control Panel > Services and make sure the Windows NT server service is
running (especially on an Windows NT Workstation). Also, make sure the "PFM
service" is started.
Q. Why do I get the error message "Security violation in all five IP
addresses in firewall.html" after I click the configuration link from the
banner page?
A. Possible reasons:
You might not be browsing to the correct address: It should be either
http://the_nt_ip_address:8080 or http://127.0.0.1:8080 (If you selected an alternate
port during installation, use that port's number.). Do not attempt to run index.html or
firewall.html; this does not work.
If your Windows NT box is multi-homed (has more than one NIC) or has multiple IP
addresses associated with the NIC, make sure all IP addresses of the machine are
listed in Program Files\Cisco\PIX Firewall Manager\jclient\netscape\firewall.html.
You can edit this file with a text editor. In some rare cases, you may need to add the
Windows NT NetBIOS hostname of this machine as one of the IP address entries in
this file. Reboot the server after you edit this file.
You may have loaded the Firewall Manager software on a Windows NT box that uses
DHCP. Firewall Manager requires a static IP Address. If you have changed from
DHCP to a static IP address, you need to edit the firewall.html file.
Q. The banner page comes up, and requests a username and password.
What is this? Can they be changed from the defaults?
A. The default administrator user name is pixadmin and the default password is cisco. The
administrator has read/write configuration abilities.
The default user (read only) username/password is pixuser/cisco. The user manager on the
server allows you to add, change, or delete users to the pixadmins or pixusers groups ypu set
up on install.
Q. Is there a log file I can look at for troubleshooting PFM problems?
A. Yes, it is called pfm.log. If you go through this FAQ and still have a problem, the TAC
requests this log.
Q. Why does PFM have numerous error messages or not load the
configuration after the install?
A. Possible reasons.
You must run the browser displayed on the banner page. Other browser versions are
not supported. PFM is optimized for specific versions of the Netscape browser. You
can download these versions from the Netscape FTP site at:
ftp://archive:oldies@archive.netscape.com/archive/index.html.
Make sure you have set up your PIX to allow Telnet from the PFM. To verify, go to a
command line, Telnet to the PIX interface, and log in to enable mode.
Your PIX has an unsupported interface card in it. Only Singleport 10/100
Ethernet/Fast Ethernet and Token Ring interfaces are supported with this product.
Your PIX version and PFM version might not be compatible. Current supported
platforms are:
14.3.2c does not support any new features or commands in PIX versions newer than
4.3(2) and may generate error messages intermittently because of these new features.
This should not affect your ability to configure the older, supported features. You can
download the correct code version from the PIX Software Download ( registered
customers only) .
Caution: To avoid lengthy network outages, always review hardware
requirements and version release notes before you perform a platform upgrade.
Q. Does PFM run on Windows 2000?
A. PFM only runs on the platform listed in the documentation, which is, Windows NT. The
successor to PFM is PIX Device Manager (PDM), which works with browsers on Windows
95, 98, NT, and 2000. PDM is available with PIX 6.0 code.
Q. How do I change the PFM administrator (pixadmin) and user (pixuser)
passwords from the defaults (which are noted in the PFM release
notes)?
A. When PFM installs, it sets up the accounts in the Windows NT user database. The
passwords for the default users may be changed as passwords are for other NT users. Go to
Start > Programs > Administrative Tools (Common) > User Manager for Domains.
Q. How can I download PFM and PDM?
A. To download the PFM and PDM software described in this document, refer to the PIX
Software Download ( registered customers only)
Q. Can I use Excel 95, 98, or 2000?
A. You cannot use Excel 95; the macros are not compatible. Excel 98 and 2000 are not
supported.
A. You cannot use Excel 95; the macros are not compatible. Excel 98 and 2000 are not
supported.
A. You cannot generate reports from the PFM active filesreport.xls, stat.dbf, dns.dbf,
monday.dbf, and so on. You must copy these files to a separate directory, and open them in
Excel 97.
Q. Why can I not download the .dbf files?
A. You cannot copy the Monday.dbf file to another directory until Tuesday, and the
Tuesday.dbf file until Wednesday, and so on.
Q. I downloaded .dbf, but report.xls contains no data.
A. Make sure that logging is configured properly. Complete these steps:
Logging traps output must be set to debug, or these files do not populate.
Verify that the logging host is pointed at the PFM server.
Make sure your configuration shows logging on.
Test successful logging by pressing the Immediate syslog notification button in
PFM's graphical user interface (GUI). This generates traffic through the PIX. Verify
the activity in the GUI pop-up window.
Q. I can open report.xls, but Excel cannot find the .dbf files it needs to
run. What is wrong?
A. You are probably using most recently used (MRU), or double-clicking on report.xls from
Windows Explorer. Excel 97 tracks MRU files at the bottom of the File men, and Windows
also tracks these in the Start > Documents menu. Do not open report.xls from those
locations. If you do, the macros embedded in report.xls do not function properly. You must
use the File > Open menu to open report.xls. When you select File > Open, Excel associates
that directory with the application. When you use MRU, Excel keeps the file's association
with the "My Documents" folder, and report.xls cannot find the .dbf files.
Q. Can I have the password to access and modify the macros embedded
in report.xls for my own use?
A. Modifications to that file are not allowed. The product can only be supported when the
code is intact. Report.xls is password protected to protect the integrity of the embedded
macros. If you have specific needs not addressed by the macro, you can either:
Write your own rendition of the macro.
Submit an enhancement request through the TAC for future release consideration.
