F5 and PIX for webserver

Unanswered Question
May 24th, 2006
User Badges:

I had a question regarding securing our webservers that use IIS. We have 2 options in play. Which one is a better solution to secure IIS from the IIS vulnerabilities and etc...? I know both have advantages and disadvantages.

Here's the setup, a Cisco PIX firewall and an F5 connected to the DMZ in the PIX. The F5 has 2 VLANS:1.1 and 1.2. VLAN 1.1 has an public IP (example: and VLAN 1.2 has (

1) place the IIS server in the internal network ( and have the F5 communicate to it to retreive the pages for Internet users. The Internet users will see a public IP address but obviously the F5 will translate that to the internal IP address in the network. Also, the server needs to communicate to a database on the internal network.

2) place the IIS server in the F5 VLAN 1.2 network ( and have F5 communicate to it that way. The server then needs to communicate to the internal network ( to access a database. Obviously we need to create open ports on the PIX at that point.

Hopefully i made sense.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
a.kiprawih Wed, 05/24/2006 - 23:30
User Badges:
  • Gold, 750 points or more


Personally, I think Option #2 looks better for more secure access.

This is similar to the concept of hosting your public webserver in semi-trusted segment. Obviously, you do not want outsider to access your internal network directly in the event if someone managed to find way to hack into the webserver. If this happened, he/she is already on your secure network segment and had a greater chance to compromise other servers. DMZ is more or less act like a 'transit area'. Another layer of ACLs for DMZ and Inside interfaces will help to prevent/minimize the risks. And of course, an IPS will be a bonus to further inspect the passing traffic, especialy when firewall has no ability to check hidden/tunneling traffic.



jliscano Wed, 06/07/2006 - 10:54
User Badges:

First you want to enable "http server enable" on the PIX. Then add your station IP address with this command "http inside.

You should then be able to https into your PIX via web.


This Discussion