PIX Emulation
PIX emulation was added with Dynagen 0.11.0, thanks to the PEMU emulator by Milen Svobodnikov, and Pemuwrapper by Thomas Pani. To add a firewall to your lab, first you must launch the Pemu Server. On Windows, use the “Pemu Server” shortcut on the desktop and in the Start menu. On Linux, use the “pemu-start.sh” script.
In your network file, define the connection to the pemu server and the firewall as shown here:
[localhost]
[[7200]]
image = \Program Files\Dynamips\images\C7200-jk9s-mz.124-12.bin
ram = 160
npe = npe-400
[[router R1]]
e1/0 = FW1 e0
[pemu localhost]
[[525]]
image = \Program Files\Dynamips\images\pix802.bin
serial = 0x12345678
key = 0x00000000,0x00000000,0x00000000,0x00000000
[[fw FW1]]
This .net file specifies the Pemuwrapper instance as running on “localhost”. It could be running also on another computer, creating a distributed lab. Then, specify the 525 section (signifying the PIX 525 that PEMU emulates) and set the defaults that will apply to all firewall instances on this PEMU server. Here you can set the “image”, ”key”, ”serial” and “ram” options. The [FW1] line creates the PIX 525 instance; whose Ethernet0 interface is connected to R1’s e1/0 interface (specified in router R1’s config).
This run the lab and you can list PEMU instances using the 'list' command:
=> list
Name Type State Server Console
R1 7200 stopped localhost:7200 2000
FW1 525 stopped localhost:10525 4000
PEMU firewalls can be stopped, started, reloaded, and of course you can attach to the console just like a virtual router. However, the following commands are not supported on PEMU firewalls:
import / export
suspend / resume
capture / filter (on firewall interfaces. You can instead capture on the “dynamips” side of the connection)
cpuinfo
copy / push
The following caveats apply to PEMU:
Currently, PEMU server only runs on Windows and Linux hosts (not OS X,). However Dynagen running on any platform can be used to communicate with a PEMU server running on a Linux or Windows host.
There is no concept of “idlepc” for PEMU; each PEMU device will consume 100% of a core. However the process does run at a low priority. You can choose to limit CPU consumption with a 3rd party tool like BES (on Windows) or cpulimit on Windows.
Dynagen does not currently support connecting PIX interfaces to NIOs (for example “e1 = NIO_gen_eth:eth0”). To get around this, bridge the connection with a virtual Ethernet switch like so:
[localhost]
[[ethsw sw1]]
1 = access 1
2 = access 1 NIO_gen_eth:eth0
[pemu localhost]
e1 = sw1 1
See the “pix” sample lab (in the sample_labs directory) for a more detailed example of utilizing emulated PIX firewalls in your labs.