Back-to-back PIX

jtorkos · ‎11-12-2003

Does anyone know if this can work. I have two Pix 515 firewalls and the setup is as follows:

ISP - Router - PIX1 - PIX2 - Internal

Remote VPN users will terminate at PIX1 and I need to know how they will get to the internal network and how the internal users will get out to the Internet.

I'm thinking of setting up IPSEC between the firewalls, but do I need to configure "isakmp enable inside" on PIX1 and "isakmp enable outside" on PIX2.

Please let me know if anyone has any ideas on this subject.

Thanks.

nkhawaja · ‎11-12-2003

Hi,

Why would this setup not work? Why do you need IPSEC between PIX1 and PIX2. Just terminate VPN on PIX1 and allow the traffic for those IPs towards and from PIX2.

For outbound traffic, simple NAT should work.

Thanks

Nadeem

jtorkos · ‎11-12-2003

Wow, what a quick response. Just to understand what you have said. I create an ip pool for VPN users and create an access list that will forward the packets to PIX2. As for internal users, I just set up NAT and they should go out the Internet. I there a chance I can send you a diagram of how it looks like or is there a Cisco link that has a similiar example.

My home email address is jtorkos@rogers.com

Thanks again.

nkhawaja · ‎11-12-2003

Hi,

You can send me diagram at nkhawaja@cisco.com

Thanks

Nadeem

jtorkos · ‎11-13-2003

I've setup the FWs, so internal users can access the Internet, DMZ and everything else. I've terminated the VPN on PIX1 and I'm able to connect from outside. However, I'm unable to get into my internal network. Do I need to add a route inside statement so that packets get forwarded from the PIX1 to the PIX2 inside interface. Perhaps, I need to add a static address? Does anyone have any ideas.

Thanks in advance.

JT

nkhawaja · ‎11-15-2003

Hi,

You definitely need route statement for the inside network@PIX2 on PIX1

route inside PIX2_outside_address

You also need the following on PIX2

static translation for inside network

access-list to allow the VPNIPs to come to the inside.

Thanks

Nadeem

jtorkos · ‎11-17-2003

It's working fine now.

Thanks for your help.

JT