Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

AP, VLANs, and PIX

2801 router

fe0/0 with a 209.x.x.x address going to a switch.

fe0/1 with a 28.x.x.x going out to WAN

515 PIX

e0 outside with a 209.x.x.x address going to same switch as router.

e1 inside with a 192.168.0.1 address going to LAN. This acts as the network firewall/gateway

Client just purchased a Cisco AccessPoint 1130AG. Client wishes to have two SSID's. One "Guest" SSID which only gives access to HTTP/HTTPS. And one "Staff" SSID which gives access to everything (network servers/shares/printers/etc).

My understanding is that the PIX doesn't handle multiple VLANs, only ASA's do. But can I use the router to route the two VLAN's? There are currently no VLANs defined.

Can anyone help me out? Do you need to see the running-config on both to be able to tell? I was just wondering if the router could do a fe0/0.1 and fe0/0.2 int and add the two different VLAN's network statements to handle the routing, then the PIX restrict the access.

That's my idea, though I'm not sure how to go about implementing it.

Do I need to be more clear?

Thanks for any time given.

6 REPLIES

Re: AP, VLANs, and PIX

Create three different vlan's on the switch,

vlan 101 - for inside LAN

vlan 102 - for WLAN 1

vlan 103 - for WLAn 2

And then connect the trunk to the PIX inside

and on the pix you need to create sub-interfaces

hostname(config)# interface ethernet0/1.1

hostname(config-subif)# vlan 101

hostname(config-subif)# nameif inside

hostname(config-subif)# security-level 100

hostname(config-subif)# ip address 10.0.0.1 255.255.255.0

hostname(config)# interface ethernet0/1.2

hostname(config-subif)# vlan 102

hostname(config-subif)# nameif WLAN1

hostname(config-subif)# security-level 90

hostname(config-subif)# ip address 20.0.0.1 255.255.255.0

hostname(config)# interface ethernet0/1.3

hostname(config-subif)# vlan 103

hostname(config-subif)# nameif WLAN2

hostname(config-subif)# security-level 80

hostname(config-subif)# ip address 30.0.0.1 255.255.255.0

Then you can create access-lists on the PIX fir restricitng traffic based on your requirements.

New Member

Re: AP, VLANs, and PIX

wow,

So you mean that I shouldn't need to alter the router configuration whatsoever?

The PIX will support multiple VLANs?

Re: AP, VLANs, and PIX

Yes , pix will support, provided you have IOS 6.3 and above.

Re: AP, VLANs, and PIX

With the command " show ver" you can check the

details available on your PIX device.

You can also refer this link. It will give more details for your platform.

http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/bafwcfg.html#wp1116060

New Member

Re: AP, VLANs, and PIX

PIX 515

interface ethernet1/1.1

vlan 101

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

interface ethernet1/1.2

vlan 102

nameif WStaff

security-level 90

ip address 192.168.2.1 255.255.255.0

interface ethernet1/1.3

vlan 103

nameif WGuest

security-level 50

ip address 192.168.3.1 255.255.255.0

2960G

interface vlan 101

description LAN

interface vlan 102

description WStaff

interface vlan 103

description WGuest

This is what I was thinking about putting in to get it started. My worry is, if I create the sub-interfaces on the PIX, will that bring down the connection to our WAN? Will I need to do any other configuration to keep it seamless for the Staff? Or will everything auto adjust to interface eth1/1.1 because of the "nameif inside" is still the same name, "inside"?

New Member

Re: AP, VLANs, and PIX

Anyone know the answer for this?

134
Views
5
Helpful
6
Replies