Pix firewall with 3 wan connection ?

Unanswered Question
May 22nd, 2006
User Badges:

We have 3 dsl line of 2 mbps each with public ip assigned. I want to go for PIX firewall, Can i use all 3 wan connection simutaneously with PIX firewall, if yes then how. Any alternate thr?. also guide me cheapest pix version to use as firewall with all 3 wan connection.

Thanx in advance

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (1 ratings)
a.kiprawih Mon, 05/22/2006 - 23:04
User Badges:
  • Gold, 750 points or more


3 links to ISP is fine, as long as you have enough ports on PIX to host those DSLs.

Try to get at least PIX515E with 4 interfaces (3 for DSLs, 1 for internal network).

By default, it comes with 2 interfaces (inside-Eth1 & outside-Eth0). When you place an order, you can either add *two (2) additional FastEthernet cards or get **1 x 4-Ports FastEthernet card.

By default, PIX515E support max 3 interface with Restricted (R) license. For 4 or more interfaces, you need to get PIX with UnRestricted (UR) software license.

*PIX-1FE : PIX single-port 10/100 Fast Ethernet interface card

**PIX-4FE-66 : PIX 64-bit/66-MHz x 4-port 10/100 Fast Ethernet interface card, RJ45


You can control connectivity/traffic from internal network/user to use any of those DSLs via NAT, Global, static nat, ACL and route.

Configuration Guide:


Hope this helps.



a.kiprawih Tue, 05/23/2006 - 01:24
User Badges:
  • Gold, 750 points or more

Your design looks simple, but need careful configuration.

You can use NAT & Global command to allow outbound connect, and ACL to restrict outbound access.



Nat (inside) 1

Global (dsl_line) 1 x.x.x.10-x.x.x.20 netmask

Global (net1) 1 y.y.y.40-x.x.x.50 netmask

Global (net2) 1 z.z.z.20-z.z.z.30 netmask

route outside x.x.x.1 1*

route outside y.y.y.1 2*

route outside z.z.z.1 3*


*PIX only accept one (1) static route with metric 1 at any time. Therefore, you need to assign priority, e.g link #1 metric 1, link 2 mteric 2 and so on, to the default route to all 3 links. PIX does not have smart routing feature like router.


But since all your internal hosts are connected directly to PIX inside interface, and need to use all 3 links to go out anywhere they want, users need to add 3 gateways in their machines, which is not really recommended due to problem with Microsoft. You can always add 2 more IPs as gateway, but host will keep looking/using the 1st gateway in the list.

You cannot use ‘route-map’ in PIX as it is used to redistribute routes from one routing protocol into another, not to specify preferred route.

You probably need to specify specific range of target/external addresses/subnets in the static route to enable internal hosts accessing specific external/internet address via specific link. In this case, you don’t need to specify the metric.


route outside 198.133.x.x.255.255.255 x.x.x.1 --> accessing http://www.cisco.com via link #1

route outside 66.102.x.x.255.255.255 y.y.y.1 --> accessing http://www.google.com via link #2

route outside z.z.z.1 --> accessing http://www.cari.com.my via link #3

One of the best option is to put Router in front of firewall, and use ‘route-map’ feature in router to define which traffic goes to which link. All 3 links need to be hooked to this router.



blue4cisco Tue, 05/23/2006 - 02:08
User Badges:

Thanx AK, u r very close to my solution. let me tell u that we r using win98 at end user would it be ok to access all 3 network with 98 using 3 gateways. my network are 23.125.12.* , 192.168.2.*, 78.561.25.*.With out a router can we implement this using PIX only. would it work ?

Waiting ur reply

a.kiprawih Tue, 05/23/2006 - 03:53
User Badges:
  • Gold, 750 points or more


I am sure it will work, except the fact that you cannot maximize the 3 links for your internet browsing or accessing external network activities.

Internet access will go mainly via Link#1 as it has highest metric or priority. The other 2 links will probably do nothing until Link#1 down.

***But again, there might be an issue as PIX will not know/aware (not intelligence) if Link#1 is down. This will make it to keep pushing/sending traffic out through that link. That's why a router is needed. But you can always use Link#2 & Link#3 for for specific traffic, e.g use Link#2 for email traffic, Link#3 for DNS and so on.

Alternatively, if you want, you can try this (attach config) theory, although this is still subjected to the above *** statement. The execption is each internal address/subnet will use specific link to go out/to internet.

For PIX OS, if possible, use the latest 6.x version.





This Discussion