VPN to Pix problem

Similar Questions

• IPSec vpn ios - pix problem

  I have a big problem and I don't know what to do. set up a VPN with the following data:

  of the encryotion, md5 hash, dh 1, pre-shared, but when I tried to affermirai the vpn router ios show me this error

  Jul 1 20:50:15.311: IPSEC (validate_transform_proposal): application for conversion not supported for identity:

  {esp-3des esp-md5-hmac}

  Help, please

  show configurations.

• Login problem VPN on PIX on the side of the inside of the n/w

  I am tring to connect to the vpn server (pix) outside my laptop within the network.

  I have routed ip vpn on pix515 and fine ping pix.but not able to ping of 3550 switch and computer laptop.

  How to get the vpn ip Switch? as I don't know the mask of the ip...

  I would also like to know... is their something extra that I need on pix or 3550?

  Hello!

  -What is the default gateway of your laptop?

  -You do any kind of NAT on the PIX? What is NAT PAT, static or normal?

  -Can you ping the inside of the PIX of the laptop?

  There could be several problems to solve here.

  (1) first of all, make sure that your laptop has access to the internet

  (2) If you want to ping him make sure internet you have an ACL on the PIX like the one below:

  i.e.

  Allow Access - list icmp an entire TEST

  TEST group access in the interface outside

  Also make sure you have no access list applied inside the PIX

  -Now, can you connect at all?

  -When you connect to? Another PIX? Router? Hub?

  If you pass by PAT make sure that you have this command on the PIX:

  "fixup protocol esp-ike.

  Please let me know if you can answer my questions, in this way, it would be easier to help you.

  Frank

• VPN to PIX access problem.

  I set up PPTP VPN on PIX 515 access with unrestricted license for Windows-based computers. I can connect but I'm unable to access all the resources on the network. I suspect this has something to access the list, but I don't know where to start. Here's the relevant part of the PIX config:

  access-list all-traffic ip to allow a whole

  access-list 100 permit icmp any any echo response

  access-list 100 permit icmp any one time exceed

  access-list 100 permit everything all unreachable icmp

  .

  IP address outside x.x.x.130 255.255.255.252

  IP address inside 192.168.254.1 255.255.255.0

  IP address x.x.x.97 255.255.255.224 DMZ1

  address IP DMZ2 192.168.251.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool vpnpool 192.168.254.201 - 192.168.254.254

  .

  Global (outside) 1 x.x.x.65 - x.x.x.93 netmask 255.255.255.224

  Global (outside) 1 x.x.x.94 netmask 255.255.255.224

  NAT (inside) 1 access-list all-traffic 0 0

  (DMZ1) 1 access-list all-traffic NAT 0 0

  Access-group 100 in external interface

  Route outside 0.0.0.0 0.0.0.0 x.x.x.129 1

  .

  Sysopt connection permit-pptp

  Telnet 192.168.254.0 255.255.255.0 inside

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  VPDN Group 1 accept dialin pptp

  PAP VPDN Group 1 ppp authentication

  VPDN Group 1 chap for ppp authentication

  VPDN Group 1 ppp authentication mschap

  VPDN group ppp 1 encryption mppe auto

  VPDN Group 1 client configuration address local vpnpool

  VPDN Group 1 pptp echo 60

  VPDN Group 1 client authentication local

  VPDN username * password *.

  VPDN allow outside

  dhcpd address 192.168.254.100 - 192.168.254.200 inside

  dhcpd dns x.x.x.131 x.x.x.200

  dhcpd rental 86400

  dhcpd ping_timeout 750

  dhcpd allow inside

  Looks like you forgot to add a "nat 0" defines that there are no PAT beween your local inside network and the PPTP DHCP pool.

  PPTP pool must be different from the inside pool otherwise it is not routable correctly.

  no ip local pool vpnpool 192.168.254.201 - 192.168.254.254

  # Choose a new network PPTP pool that is not in use

  example of dansMon # is 192.168.1.0/24

  IP local pool vpnpool 192.168.1.1 - 192.168.1.254

  access-list 101 permit ip 192.168.254.0 255.255.255.0 192.168.1.0 255.255.255.0

  (Inside) NAT 0-list of access 101

  See this site for more information:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080143a5d.shtml

  http://www.Cisco.com/pcgi-bin/support/browse/psp_view.pl?p=hardware:PIX & s = Software_Configuration

  see PPTP

  sincerely

  Patrick

• VPN concentrator + PIX on LAN-> customers can not reach local servers

  Hello

  I have a problem wrt. remote access clients coming via a VPN3000 concentrator and trying to access local servers.

  For the topology:

  The internal network is 10.0.1.0/24. It connects with the outside world, as well as via a PIX DMZ; the PIX has 10.0.1.1 in the internal network.

  On the same LAN (internal), I have the VPN concentrator for the inside address 10.0.1.5. It assigns addresses in the 10.0.100.0/24 range to the

  VPN client-PCs.

  I can sucessfully connect using the VPN client SW to the hub, i.e. remote access clients out addresses

  the 10.0.100.0/24 range.

  The problem: access from VPN clients to internal network is * not * possible; for example, a customer with 10.0.100.1 cannot connect to

  internal to the 10.0.1.28 server.

  To my knowledge, this is a routing problem because the server (10.0.1.28) has no idea on how to reach customers in

  10.0.100.0/24. The only thing that the server is a default static route pointing to the PIX, i.e. 10.0.1.1.

  So I set up a static route on the PIX for 10.0.100.0 pointing to the hub-VPN, that is

  Mylan route 10.0.100.0 255.255.255.0 10.0.1.5 1

  This does not solve my problem though.

  In the PIX logs, I see the entries as follows:

  % 3 PIX-106011: deny entering (no xlate) tcp src trainee: 10.0.1.28 (atlas) / 445 intern dst: 10.0.100.1 (pending) 1064

  The PIX seems to abandon return packages, i.e. traffic from the server back to the client

  To my knowledge, the problem seems to be:

  Short traffic VPN - client-> Concentrator VPN-> Server-> PIX - where it gets moved.

  My reasoning: the PIX only sees the package back, i.e. the package back from the server to the client - and therefore decreasing the

  package because he has not seen the package from the client to the server.

  So here are my questions:

  (o) how do I configure the PIX that I be connectivity between my remote VPN clients (10.0.100.0/24) and

  computers servers on the local network (10.0.1.0/24)?

  (o) someone else you have something like this going?

  PS: Please note that the first obvious idea, installation of static routes on all machines on the local network is not an option here.

  Thank you very much in advance for your help,.

  -ewald

  Hello, PIX the because can not route traffic on the same interface (prior to version 7.0 anyway), I suggest you two places your hub to the outside with the inside of the legs on a zone demilitarized or (if you can not do a makeover of the network) you remove your pool with 10.0.100.0 - addresses and create a pool with 10.0.1.0 - addresses which is a part of the address space. No, NOT all. A little book that it is not used inside.

  Best regards

  Robert Maras

• Information on the routing of traffic of the client VPN to PIX.

  Hey all,.

  I could follow the VPN Wizard included in the PDM and able to connect with the VPN Clients for the PIX. But I'm looking for more information about how the routing is done.

  For example, my remote is 67.71.252.xxx and my inside is 192.168.1.xxx. But if I connect via VPN to PIX Client, all data is transferred through my VPN to PIX and then trying to get out to the Internet.

  I'll settle for data goes 192.168.1.xxx for transit through the VPN. This configuration made via the PIX or is it the responsibility of the Client machine to set up rules of the road?

  All links to the guides to installation, or technical notes would be great.

  Thank you inadvance.

  Paul

  Hello

  I think the key word you are looking for is "split tunneling". This can be validated on the PIX using the vpngroup split access_list tunnel GroupName command.

  "Split tunneling allows a remote VPN client or encrypted simultaneous Easy VPN remote access device to the corporate network and Internet access. Using the vpngroup split-tunnel command, specify the access list name with which to associate the split tunneling of traffic. "

  In this example configuration: http://www.cisco.com/warp/public/110/pix3000.html, note that the same access list is used to "nat 0" and split-mining:

  access-list 101 permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0

  (Inside) NAT 0-list of access 101

  vpngroup vpn3000 split tunnel 101

  Order reference:

  http://www.Cisco.com/en/us/products/sw/secursw/ps2120/products_command_reference_chapter09186a00801727ae.html#wp1099471

  Please let us know if this helped

  Kind regards

  Mustafa

• Site to site VPN PIX problem

  Hello, I have a problem when I need to implement a VPN IPSEC with ESP and key pré-partagées between two sites...

  The two sites are using PIX Firewall (Version 6.3 (3) to complete the VPN)

  I'm ok with the VPN configuration and have tested & it works

  the problem is that the PIX at the remote end must be behind a DSL router that is PATting for the PIX

  This is because the ISP can only assign a public IP address and that is to their adsl router and I don't have a public IP address that I can directly attribute to the PIX...

  is there some way I can put the second PIX address of outside interface on a private and still make a VPN connection with it?

  LAN1---PIX1---INTERNET---ADSLROUTER---PIX2---LAN2

  Thank you very much

  You will not be able to specify PIX2 private address in the config of PIX1, cause your ESP packets never get there through the Internet.

  The only way it would work is to configure the port on the ADSL router mappings, which maps the specific packages through to the PIX interface address. Config of PIX1 would then point to the ADSL router interface address.

  Or you can talk to the ISP and try and get another IP address, and then create a mapping on the ADSL router and everything for this grace IP address to map to the PIX.

  Or you could configure PPPoE directly on the PIX and get rid of the ADSL router in total. See here (http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/config/pixclnt.htm#wp1072346) for more details.

• Accounting customer VPN on PIX 515 worm problem. 6.3

  Hello everyone! Is it possible to configure PIX 515 worm. 6.3 to send logs to the RADIUS to break when a VPN Client user loggs in and outside loggs? I can't find any aaa accounting command which allows this.

  Hello

  Accounting of VPN was added in PIX 7.x. It is not available with 6.x

  Kind regards

  Vivek

• Help the Site VPN Site PIX 501

  Hello

  I'm pretty new to PIX firewall, so I hope someone here can help me.

  I have two PIX and try to create a private network virtual between the two PIX. I posted the configs below.

  The problem is that I can ping PIX on a PIX two, but I can't ping the servers behind TWO PIX. On two PIX, I cannot ping PIX ONE or all the servers behind it.

  Any advice would be appreciated.

  Thank you

  PIX 1

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  hostname TMAXWALES

  domain ciscopix.com

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  names of

  inside_outbound_nat0_acl ip 192.168.254.0 access list allow 255.255.255.0 192.1

  68.1.0 255.255.255.0

  outside_cryptomap_20 ip 192.168.254.0 access list allow 255.255.255.0 192.168.1

  .0 255.255.255.0

  pager lines 24

  interface ethernet0 10baset

  interface ethernet1 10full

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside of *. *.198.139 255.255.255.248

  IP address inside 192.168.254.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.254.10 255.255.255.255 inside

  location of PDM 192.168.1.0 255.255.255.0 outside

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Route outside 0.0.0.0 0.0.0.0 *. * 1.198.137

  Timeout xlate 03:00

  Timeout conn 0 half-closed 01:00:10: 00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 TR

  p 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.254.10 255.255.255.255 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  outside_map 20 ipsec-isakmp crypto map

  card crypto outside_map 20 match address outside_cryptomap_20

  card crypto outside_map 20 peers set *. *.198.138

  outside_map crypto 20 card value transform-set ESP-3DES-SHA

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP key * address *. *.198.138 netmask 255.255.255.255 No.-xauth non - co

  Nfig-mode

  part of pre authentication ISAKMP policy 20

  ISAKMP policy 20 3des encryption

  ISAKMP policy 20 chopping sha

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  Telnet timeout 5

  SSH timeout 5

  Terminal width 80

  PIX 2

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  hostname tmaxbangor

  domain ciscopix.com

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  names of

  permit 192.168.1.0 ip access list inside_outbound_nat0_acl 255.255.255.0 192.168

  . 254.0 255.255.255.0

  permit 192.168.1.0 ip access list outside_cryptomap_20 255.255.255.0 192.168.254

  .0 255.255.255.0

  pager lines 24

  opening of session

  debug logging in buffered memory

  interface ethernet0 10baset

  interface ethernet1 10full

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside of *. *.198.138 255.255.255.248

  IP address inside 192.168.1.1 255.255.255.0

  IP verify reverse path to the outside interface

  IP verify reverse path inside interface

  the IP audit info action alarm reset drop

  reset the IP audit attack alarm drop action

  location of PDM 192.168.1.0 255.255.255.0 inside

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Route outside 0.0.0.0 0.0.0.0 *. * 1.198.137

  Timeout xlate 03:00

  Timeout conn 0 half-closed 01:00:10: 00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 TR

  p 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  http 192.84.7.111 255.255.255.255 inside

  http 192.168.1.10 255.255.255.255 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  outside_map 20 ipsec-isakmp crypto map

  card crypto outside_map 20 match address outside_cryptomap_20

  card crypto outside_map 20 peers set *. *.198.139

  outside_map crypto 20 card value transform-set ESP-3DES-SHA

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP key * address *. *.198.139 netmask 255.255.255.255 No.-xauth non - co

  Nfig-mode

  part of pre authentication ISAKMP policy 20

  ISAKMP policy 20 3des encryption

  ISAKMP policy 20 chopping sha

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  Telnet 192.168.1.0 255.255.255.0 inside

  Telnet timeout 50

  SSH timeout 5

  Terminal width 80

  Can't see anything obviously wrong with the configs. You have these connected back to back on the same subnet, it looks that it even if you have xxx out IP addresses? If so it's maybe a routing problem, in what they send everything to the default gateway of xxx.x.198.137 rather than to the other.

  Try to add a static route to the remote subnet to each PIX that points directly to the peer, so on PIX1 you should have:

  Route outside 192.168.1.0 255.255.255.0 xxx.x.198.138

  and on PIX2 do:

  Route outside 192.168.254.0 255.255.255.0 xxx.x.198.139

  and see if that makes a difference. Note that you wouldn't encounter this problem when these two PIX is on separate networks and uses the default gateway for all routing decisions.

  If this still fails, run 'debug cryp isa' and ' debug cry ipsec "on the two PIX are trying to build a tunnel again, and then and send us the output.

  Also, make sure your tests that you're rattling to a host behind a PIX to a host behind the other PIX, ping PIX to PIX or host because of PIX that won't test your VPN connection.

• VPN via Pix 515

  Hello forum, I have a question please answer if someone knows the answer...

  Here is my scenario:

  Central location Pix515 (192.168.0.0/24)

  Location 1: (192.168.1.0/24)

  Situation 2: (192.168.2.0/24)

  Location 3: (192.168.3.0/24) local pool for vpn clients

  192.168.0.0/24, 192.168.1.0/24 lan - LAN IPSEC

  192.168.0.0/24 for 192.168.2.0/24 lan - lan IPSEC

  192.168.0.0/24 to 192.168.3.0/24 ezvpn IPSEC

  Question:

  Is it posible to connect Location1 and Location2 via Pix, or Location1 and Location3?

  On encryption ACLs on each location of traffic destined to another location is included for the encryption process.

  for example, location1 acl:

  Access 100 per 192.168.1.0 255.255.255.0 192.168.0.0 255.255.255.0

  Access 100 per 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

  Access 100 per 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

  other locations have a similar LCD-s

  There is no problem to access locations 192.168.0.0/24, but traffic between sites does not work.

  I think that pix encrypt packets outside ariving.

  I know, it's possible on IOS with IPSEC over GRE tunnels with some routing, but PIX?

  Republic of Korea

  Hi Rok-

  Allows traffic between VPN sites does not currently work with Pix OS 6.3.4 and earlier. Code pix 7.0, which will be published later this year, will enable traffic between the same interfaces of VPN security level. This will allow talked to talk communication. I have configured the week last with Pix 7.0 beta code, so I know this is a new feature and it will work.

  IOS does not have this limitation with IPSec. The GRE is not required to IOS to make communication speaks to talk work, although it can be used.

  I hope this helps you understand what is happening.

  Please let us know this that followed by questions that you have.

  Thank you!

  Peter

  PS., pls remember to note the positions so others will know if we have provided you with the information you need!

• Cisco VPN client, PIX, and proxy

  Hi.I have problem in my company. We have users that go through a proxy server located in the DMZ of a PIX to the internet (allowed through the ACL of the DMZ on the outside, etc.). Which works very well.

  The problem arises when they use a Cisco VPN client to connect to another company, and they can no longer access the Internet, but may work via VPN to a remote site (client has been authorized by the Cisco PIX). Everything returns to normal when they no longer use the VPN client.

  Any ideas why this would happen?

  Without the proxy, browsing the internet via the vpn connection, or split tunnel is configured and you are leaving locally. If split tunnel is configured, the ip address of proxy server can overlap with the remote protected network.

  Fortunately, it is easy for you to know how the vpn is configured, just check the route details of vpn client statistics tab.

  Verify that the routing table local pc will also help you to solve this problem.

• Save the password on the Client VPN with PIX

  I'm running a PIX 515 6.1 (2) configured for a small number of VPN clients. I want VPN clients to automatically remember the password of login for users do not have to enter it each time (we have an application which periodically autoconnexions).

  While it is a configurable option with concentrators 3000 series, it seems not be configurable with the PIX.

  The only work around, I can find is to make the connection file (.pcf) read-only and set SaveUserPassword = 1. The problem

  which is the password, and then must be stored in clear text in the file and it becomes inconvenient for the user to change their password.

  Does anyone know if the command exists on the PIX from the VPN client to save the connection password?

  Thank you

  Misha

  The command to do this is not currently available on the PIX. He has just been included in the IOS EZVPN server functionality, but have not heard of anything anyone yet as to if it will be included in the PIX.

  If you want this feature, do not hesitate to contact your account manager and have them grow for him, the more customers requesting a new feature faster he gets.

• Question - VPN on PIX

  Our PIX firewall allows any set up inside. In the past, we have tried to establish a VPN connection from inside our network to a hub on the Internet VPN and it did not work. We were told that do VPN behind a firewall is not possible (I don't remember who said that). However, last week we had a customer VPN to their network through our firewall. I don't have the details on the equipment or Protocol. Technically, I would like to know what can and cannot be done from the inside using VPN and to understand the reasons. We went through a few updates on the PIX from v5.0 to v6.2, and I suppose this may have something to do with it. If someone could help or point me to documentation that explains this in detail, it would be highly appreciated.

  Thank you!

  Lori White

  The big problem with IPSec through a firewall is not so much the filtering (specific protocols can easily be let go), but generally the NAT'ing or more precisely, the PAT'ing (Port Address Translation). VPNS use IPSec or PPTP usually, that use a protocol that is not TCP or UDP based (ESP and GRE respectively). Whe ndoing PAT however, it relies on a TCP or UDP port number to differentiate the different sessions and so when a protocol arrives who doesn't have it, it is usually deposited by the PAT device ' ing.

  Many VPN solutions are now a feature called IPSec via UDP, or via TCP or transparency IPSec IPSec, or whatever you want to call. Basically, the VPN client and the hub encapsulate IPSec ESP packets in a packet UDP or TCP depending on the implementation, this p [rescue can be PAT would have correctly and everything works fine. Your client was probably using something like that.

  PIX 6.3 code will support IPSec and PAT, but only for an internal IPSec session. You are the best solution is to see if any VPN software you are using supports a kind of UDP or TCP encapsulation, then you'll be off and running.

• Access ssh via VPN to PIX

  Hi people,

  Unable to access the PIX inside interface using ssh.

  The VPN works well and can access other devices more far in the network without problem.

  local IP NETWORK-SUPPORT-POOL pool 192.168.31.241 - 192.168.31.254

  vpngroup-grip LOAD NETWORK address NETWORK-SUPPORT-POOL pool

  vpngroup-grip LOAD NETWORK Server dns adc01-Interior

  vpngroup split of NETWORK-SUPPORT NETWORK-SUPPORT_splitTunnelAcl tunnel

  vpngroup NETWORK-SUPPORT-idle time 3600

  NETWORK-SUPPORT vpngroup password of some

  list of access NETWORK-SUPPORT_splitTunnelAcl allowed ip 192.168.0.0 255.255.0.0 any

  See you soon

  Tony

  Tony,

  What you need to do is this...

  (config mode you PIX)

  SSH 192.168.31.0 255.255.255.0 inside

  When you connect through your VPN client, the Interior of interface type IP address of your PIX on your SSH Client (I use Putty SSH). Additionally, make sure that you have found for ssh rsa keys to work!

  If you're still having problems, then (again in mode config) add: management-access to the Interior.

  Hope this helps and please rate messages! :)

  Jay

• Remote VPN with PIX without access to the local network

  Hi @all,

  I ve running into problems and I have not found any solution. Can someone check my config?

  Facts:

  PIX 501 6.3 (3)

  4.04 VPN client

  Wanted solution: access to HO via VPN

  VPN tunnel will be established, I get an IP address, but I can´t the systems behind the pix and the pix of access itself.

  To the VPN Client Staticts, I see outgoing packets, but no entrant (if I send a ping to peer behind the pix)

  I hope someone can help me

  Attached is my config:

  PIX 501 and 506/506e pix are not supported in v7 due to the fact that the cpu is not able to deal with the extended features of v7.

  PIX 520 is not supported I guess it's because of the fact that the model is discontinued.