Re: Just can't wrap my head around it.

ciscoadmin · ‎11-08-2006

We need to split off our users to a different subnet. My first thought is to put a 2620 between the two subnets and behind the firewall. The design is like so. Interner router then fire wall then internal router then switches for each subnet. We have servers that are email gateways and webmail and web access. My question is if I place this router in between the servers and the firewall how can I still make the web facing services avalible?

spremkumar · ‎11-08-2006

Hi

Instead of brining in a new router in your network which is again a one point of failure try to configure different zones in your firewall if you have the compatibility/feature available with your current box.

Place the servers onto the less secured zone and your lan onto a highly secured zone.

regds

ciscoadmin · ‎11-09-2006

Well I had not thought of that and I will look into it. We are looking to have the servers on one subnet say 172.16.1.x and the users on 172.16.10.x will the pix be able to handle traffic like that users talking to email and such? That is why I thought of a router first.

amit-singh · ‎11-09-2006

Yes, The Pix will be able to handle the traffic like that. Pix is a security device provides the secure connectvity by filtering the unwanted traffic between the different zones.

HTH,

-amit singh

ciscoadmin · ‎11-15-2006

Could this be done using Vlans on my switches? Or would it be best done on the PIX. If so is there sone documentation on the PIX setup?

spremkumar · ‎11-15-2006

Hi

You can configure vlans in your pix firewall as per your requirement which also depends on the number of vlans supported in the particular platform.

VLAN support comes up with PIX OS version 6.3 onwards..

you can refer this link for more info..

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172786.html#wp1113411

regds

ciscoadmin · ‎11-16-2006

Thanks for the info I will look into it. Now with a vlan on the Pix I assume I would need vlans on the switches alos right?

ciscoadmin · ‎11-16-2006

Here is another question I can install 2 nics into the Pix, I am thinking I could segment off the servers on one of those nic. Is my thinking correct?