A good pick for small businesses.

I am a network engineer working with a company that consults to nonprofit agencies. Many nonprofits don't use technology well, and don't know what's out there. Fortunately, there are a few ways by which technology companies donate their products to nonprofits -- they do have to buy the hardware or software, but the price is ridiculously cheap (compared to the open market.) Therefore, the price paid I have marked is NOT the price you can get it for, unless you represent an honest-to-God 501(c)3 tax exempt corporation.

Cisco is known for ruling the routing market, and they have made some of their lower-end hardware available to nonprofits. From their now-retired PIX line, they offer the 501 and the 506E. Since the 506E has a better processor and more RAM, and the cost between the two is a grand total of twenty dollars, I have recommended the 506E to my clients.

The 506E does not offer a lot on the outside. Unlike the 501, it does not have a built-in switch. Instead, it offers a USB port that, by Cisco's own admission does...absolutely nothing. It has two RJ-45 Ethernet ports on the back; one for your 'inside' network, one for your 'outside'. It has the ubiquitous console port that Cisco puts on everything (which is also RJ-45.)

On the inside, though, Cisco has made a very flexible, usable unit. The PIX OS is the same as the higher-end units run (with a caveat, which I will get into later.) It offers the Pix Device Manager or PDM, which is a web-based GUI that can offer a lot of configuration options. This being a Cisco product, however, there are going to be times you need to go to the command line. (If you call Cisco for technical support, they will support you through the command line.)

The PDM is Cisco's web-based command tool. It still doesn't make things super easy, but many tasks can be done through it. I usually use the PDM to get a 506E set up and rolling for the first time -- for the basics like IP addresses, DHCP scope, and the like, it's quicker than the command line. The PDM also has a command line window, so you can enter command-line commands that way.

So what can the 506E do? Quite a lot that its bigger brothers can. It supports IKE/Ipsec VPN's -- site to site or remote access VPN's. It can serve as an Easy VPN client or server. This is Cisco's means of simplifying a VPN by dynamically pushing the configuration of a VPN down to clients, whether they be hardware-based (like other PIX's) or software-based (like the Cisco VPN client).

The 506E can handle the routing needs of a small organization quite easily. Its default is a standard Class C addressing scheme (192.168.1.X) on the inside. That setup works just fine and dandy for most locations (unless there are more than 254 computers and other network devices.) Can you change it? It's Cisco, of course you can.

The 506E is a firewall, and its job is to block ports. It does this well. Basically, connections from the inside to the outside world are allowed; connections originating from the outside world are denied, until you decide what to open up.

Most of my clients bought the PIX in order to set up a VPN. The 506E handles this well. It supports DES, 3DES, and AES. It can serve as a remote access VPN (where the user has a software client installed on their computer and uses it to create an encrypted tunnel from anywhere on the internet) or a site-to-site VPN (where two separate locations want to create an encrypted network-to-network tunnel, where the individual computers have no idea that they're using a VPN.) One client wanted a dynamic site-to-site VPN, where one side of the tunnel had a dynamic IP address (cable modems). I wondered if the 506E would be able to handle this, since it is a lower end unit. Well, it is. One PIX 506E is handling seven encrypted tunnels between locations just fine.

Are there negatives? Sure there are. The PIX 506E comes with PIX OS 6.3. The bigger units are up to 7.0 by now -- or probably a little higher. In order to run the latest PIX OS, you have to put the maximum amount of RAM in the machine (64 MB), and there will be no room for the PDM. If you don't like the command line, that's a big concern.

Perhaps the biggest negative is this: you're going to need a professional to configure it. After setting up several of these, I can generally get one in short order. John Smith the business owner is not going to be able to set this up except in the most basic way. If that's what you want, this is not the unit for you.

The 506E is a lower-end unit. It only supports RJ-45 Ethernet connections. If you have a cable modem or a DSL modem, you're good to go. If you have a T1 line, you will need another unit (most likely a Cisco router) to sit between the PIX and the T1 connection. It just won't plug in. Its fastest speed is 100 Mbps. No Gigabit ethernet here. (It's also worth pointing out that a business that this would be a concern for is likely to run a higher-end unit.)

And of course there's the question of technical support. Buying a new PIX will get you one year of technical support. You can always buy a support contract from Cisco.

Cisco's technical support is good, but not great. The problem I have found is that they grade support calls on the severity of the call. Configuration calls are category four -- the lowest category. What does that mean for you? It means that if you want help setting up your PIX, you don't call and get help. You call, put in your ticket, and then you wait. Usually you'll get a call back the next day. Once you get them on the phone, they're great. But until you do, you're sitting there staring at your PIX, wishing it would work. Once it's up and running, if it goes down, THEN you can get immediate help.

But if you know these things going in, the 506E is a great choice. If you're trying to get into Cisco yourself, the 506E is a great unit to learn on. I liked it enough that I bought one for my home network, so I have something to play with to get my CCNA.

Want some quick and easy stats?

Technical Specifications
Processor: 300-MHz Intel Celeron Processor
Random access memory: 32 MB of SDRAM
Flash memory: 8 MB
Dimensions (H x W x D): 1.0 x 6.25 x 5.5 in. (2.54 x 15.875 x 13.97 cm)
Weight: 0.75 lb (0.34 kg)

Console Port: RS-232, 9600 bps, RJ-45
Outside: Integrated 10/100 Fast Ethernet port, auto-negotiate (half/full duplex), RJ-45
Inside: Integrated auto-sensing, auto-MDIX 4-port 10/100 Fast Ethernet switch, RJ-45


If you want even more stats on the PIX 506E, you can check them out at http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_data_sheet09186a0080091b13.html

There's enough to satisfy the geekiest among us.

The PIX 506E is readily available from several retailers online. It offers a great deal of power in a small package. It's a great way of getting a Cisco quality firewall for small businesses at a reasonable price.