1. The T1:
If the 1720 is currently providing service to a frame network and you connect the T1 to this same 1720, that frame network will be "outside" of the PIX firewall protection if you connect the 1720 ethernet to the PIX outside interface.
Ideally, you'd have something like this:
ISP
|
router 1720
|
PIX--DMZ
|
internal router---frame relay net
|
internal network
I suspect you are planning on doing this:
ISP-router-frame relay network
|
PIX--DMZ
|
internal network
If you do you may have to use some ACLS/NAT to protect the frame relay hosts.
What kind of CSU do you have? What type of WIC do you have in the 1720? If you have a CSU that can handle multiple T1s and also has multiple data ports, you can connect a WIC-1T from the 1720 via a V.35 cable to the CSU. Then connect the T1 to a free NI port on the CSU. If you have an internal CSU on the 1720, just connect the T1 right into it. The default settings on an internal CSU should be fine.
2. NAT
You should probably do NAT on the PIX like this:
ISP--1720--PIX-
|
DMZ
subnet1=probably ISP assignend /30 (255.255.255.252)
subnet2=you can make one up there like 192.168.10.0/24 (be sure to add a static route on the 1720 for your ISP assigned subnet to go via the PIX, e.g. the 1720 eth0 is 192.168.10.1 and the pix outside is 192.168.10.2 and your ISP assigned subnet is x.x.x.x 255.255.255.240, add a static route on the 1720->ip route x.x.x.x 255.255.255.240 192.168.10.2)
-your internal network
-a made up subnet like 192.168.20.0 255.255.255.0
If you use the 192.168.10.x subnet between the 1720 eth and the pix outside, you'll have something like this on the PIX:
PIX interfaces:
ip address outside 192.168.10.2 255.255.255.0
ip address inside 10.0.0.1 255.255.255.0 (your private internal subnet)
ip address dmz 192.168.20.1 255.255.255.0
Do nat:
nat (inside) 1 10.0.0.0 255.255.255.0 (NAT everything from inside)
nat (dmz) 1 192.168.20.0 255.255.255.0 (NAT everything from dmz)
global (outside) 1 x.x.x.1 (This is for PAT, choose one of your legal assigend IPs for overload)
global (dmz) 1 192.168.20.0 255.255.255.0
give your servers labels:
name 192.168.20.1 mail
name 192.168.20.2 web
name 192.168.20.3 virus
static (dmz,outside) x.x.x.1 mail (this is the mail server one-to-one-NAT)
static (dmz,outside) x.x.x.2 web (this is the www server one-to-one-NAT)
static (dmz,outside) x.x.x.3 virus (this is the virus server one-to-one-NAT)
(take care of allowing SMTP/www inbound to dmz)
access-list aclt permit tcp any host x.x.x.1 eq 25
access-list aclt permit tcp any host x.x.x.2 eq 80
access-group aclt in interface outside
(take care of the default route)
route outside 0.0.0.0 0.0.0.0 192.168.10.1
telnet 10.0.0.100 255.255.255.255 (or whatever your PC is behind the PIX...this allows you to telnet into the PIX)
(configure telnet and enable passwords)
enable password xxxxx
passwd xxxxx
You don't need BGP.
I think the biggest thing is if the 1720 is going to be your Internet router *and* the frame router.
I think once you get all that up, you could start on the VPN solutions:
http://www.cisco.com/pcgi-bin/Support/browse/psp_view.pl?p=Hardware:PIX&s=Software_Configuration
and
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/config/index.htm
-HTH
