I have always wanted to have a pix.. and so I decided one day, yes.. I will run a pix firewall for my home firewall. Overkill? Sure.. But what's worth doing is worth overdoing, so the Mythbusters have taught me.
There are 2 PC100 RAM slots inside, so the first thing I did was buy another 32Megs. Turns out, I didn't really need to because the ram usage never really topped 17Meg, which is what it starts out at, and never climbs. The load on the CPU, which was a Celeron 300Mhz with a 66Mhz bus, was at a load of somewhere between 2~7%, depending on how many connections were open. I manage to get it up to 49% usage, when I was doing 3DES VPN. I picked 3DES to test because AES is much more efficient, and I wanted to load up the CPU. The CPU runs really really hot..
Upon reading the Cisco Pix Wiki , I discovered that the motherboard of the 506E is the same as the Pix 525, which has a 600Mhz Coppermine Pentium III CPU. So I put that on my todo list. I surfed and googled around, and found a guy who hacks Ciscos. I asked him about it, and he said it was a fairly strange idea but probably quite doable. So researching, I figure I would try to mimick the specs of the original 506E but times 2.
Cisco Pix 506E's CPU (Original):
300Mhz Celeron with 66Mhz Bus on Socket 370
(Ugly looking CPU with no markings on it.. It's made of ceramic, very heavy, and really hot.
Planned Modification:
600Mhz PentiumIII with 133Mhz Bus on Socket 370
.jpg)
The reason I picked these specifications were for a number of reasons:
- I was scared that with the horrible heat distribution of the 506E, a super fast CPU might burn the mobo.
- I didn't want to pick something with a 100Mhz bus because I wanted the multipliers to be multiples of the original. So in this case, 300Mhz => 600Mhz. 66Mhz bus => 133Mhz bus. I figure compatibility would be better this way and I'd have a better shot at making this work.
- Because the 525 uses a 600Mhz and I assume the same motherboard, or at least it uses the same Intel 440BX Seattle chipset onboard.
- The voltage requirement was lower than the Celeron, not higher.
So I found one on the Taiwanese ebay for $4USD. So I bid and bought it. Today was the big day. I pulled out the Celeron and slapped in the PIII. The "theory" was that I just slap some heat transfer compound, close it up, turn it on, and away it goes!!
And... (drum roll).. it just booted up. Absolutely no drama whatsoever. Now, the CPU runs at 0% all the time... I am not sure if it's running at 66Mhz or 133Mhz, and don't know how I'd be able to check, but in theory, this chip is 4x faster (300Mhz vs 600Mhz) and (66Mhz vs 133Mhz) I doubled the clock bus speed as well as the CPU speed.
The other part of the good news is that the Celeron ran at 2.0V, while the PIII runs at 1.65V. So the lower voltage should be a heatsource and power savings (hopefully). The heatsink on the Celeron is MASSIVE. The one on the PIII is really dinky, so I hope that heat transfer isn't a problem.
I don't really do any VPN or anything that drastic with my firewall.. If I did, I'd upgrade it to 256Megs of ram or something. Anyway, my 506E is effectively running like a 525.
506E (New) MSRP $1549 USD
525 (New) MSRP $4000 USD
32Meg additional PC100 ram cost me $10.
PIII 600Mhz with 133Mhz bus, cost me $4.
So if you buy a 506E and dump another $20 into it, you will have a 525 equivalent. Yes yes yes, I know, 525 will run the ASA. You can hack the 506E to run ASA as well. But I don't need UTM and so no need for me to. I might do it though just so I can truly have a hacked 506E. But for now, I'm super happy with the CPU upgrade.
You can pick up a 506E for cheap on evilbay, and PC100 ram is cheap, and so are PIII's. If you are brave (or stupid) and would like to try an even faster CPU, knock yourself out. But so far, no problems with the PIII. I am still concerned about overheating so time will tell.
From Tom's Hardware :
| Celeron | Pentium III | |
|---|---|---|
| Socket | Socket 370 | Socket 370 or Slot-1 |
| Processor Speeds | 366, 400, 433, 466, 500, 533, 566, 600, 633, 667 MHz | 500, 533, 550, 600, 650, 667, 700, 733, 750, 800, 850, 866, 933, 1000 MHz |
| L2 Cache Speed | Full CPU clock speed | Full CPU clock speed |
| Operating Voltage | 2.0V (366-533 MHz) 1.5V (533A-600 MHz) | 1.60/1.65V/1.70V |
| L2 Associativity | 4-way set | 8-way set |
| Price of slowest model | $70 for 366 MHz | $175 for 500 MHz |
Note that the L2 cache is much bigger on the PIII, 2x as big. Also, the bus speed as well as the inherent CPU speed.
So there you go! Hack your 506E into a near 525.
~~~~~~~~~~~~~~~~~ Update ~~~~~~~~~~~~~~~~~
I am curious, the "show version" shows PIII 448Mhz.. ???!?! Oh well..
Copy & Past Below:
Cisco PIX Firewall Version 6.3(5)
Cisco PIX Device Manager Version 3.0(4)
Compiled on Thu 04-Aug-05 21:40 by morlee
pixfirewall up 32 mins 3 secs
Hardware: PIX-506E, 64 MB RAM, CPU Pentium III 448 MHz (Why 448Mhz?? I'm not sure.. Mobo restriction??)
Flash E28F640J3 @ 0x300, 8MB
BIOS Flash AM29F400B @ 0xfffd8000, 32KB
Since I don't have the budget of cisco, I really couldn't test the router in the way I would like to.. so I had to start thinking up creative ways. So..
I created a 3DES VPN from my desktop (Windows XP) to the router. I then looked for an open iperf computer online, (Thank you University of Florida! ) and begin to iperf the crap out of it.
I then did a
iperf -c [server] -u -b1000m -w2m -i1s
to see if I can get the CPU load up. Well.. I ran 10 of these concurrently, for a full cached saturation of close to 80megs of data. (I'm sure my ISP is gonna ban me now..) I got the CPU up to 75%. So that means on this setup, I can reasonally expect about a 100meg ceiling for VPN. (I picked 3DES instead of AES because the load is heavier on 3DES and the goal was to load up the cpu). Without VPN, the load topped around 11%. For regular usage though, the system shows 0% utilization. So there you go, I haven't quite figured out how to spawn a ridiculous amount of connections to test, but I have over 200+ BT files going, and the connection load floats at around 1000+ at any given time, so it's not too bad. All in all, excellent upgrade. Will I notice a difference in my browsing? Probably not. Will I smile with pride and joy at hacking yet another piece of hardware? Absolutely.
My actual pics:
Here's the Pix 506E opened up. Notice the 2 rows of 32Megs of ram. I will probably upgrade this later.
Here's a pic with the CPU fan off, showing the Celeron.
Here's a Celeron vs PIII shot.
And Finally, here's the PIII installed.
One more comment; I changed out the CPU thermal compound and the box got HOT.. which is a good thing, which means it's wicking the heat from the CPU much better. I was originally concerned about the heat since the heat sink contact point on the PIII is so small compared to the Celeron.. The compound on the Celeron had hardened already, and so changing it out is a great idea regardless if you are going to upgrade the CPU or not.
