Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

How do I introduce a PIX/Router into my network?

My network currently connects to the world via our dual homed ISA server. It plugs directly into the outside NIC of the server - no router. The external DNS server points to that one outside IP Address. The ISA server is also our Websense Server. I want to change it all and use a parimeter router/PIX configuration.

I don't understand the best practice method of IP addressing all the parts. I am using a 172.200.x.x/23 scheme inside my network and I have a that is available to me to use. I currently use .5 as my outside NIC address and that's the address in the MX record. I would like to set up a NAT/PAT on the firewall, but I'm not sure how to do the IP addressing between the firewall and the router and should I assign that .5 address to the outside interface on the router so that my mail can find me? I'm kind of confused by it all. I'd appreciate any help I can get.

New Member

Re: How do I introduce a PIX/Router into my network?

You must have a router or access point already to connect to the outside world, ie the default gateway on the external NIC on the ISA box. Depending on your requirements for web servers etc alters the model of pix to buy. You could do it with a router with the fw feature set but I would advocate getting a separate PIX. As a quick dirty guide you would setup the pix on a different IP from any other box. You can then use translation to translate the .5 address to the internal IP of your SMTP gateway. You are already using NAT for all outbound connection so assign the default gateway for your internal PC's to the pix internal interface and configure translations accordingly. Configure your ACL's for the access required (remember that an ACL is needed on the external interface for you .5 address).

Hope this helps


New Member

Re: How do I introduce a PIX/Router into my network?

Hi Andrew,

You cannot assign the ".5" address to the router's outside interface. .5 must be assigned to the f/w's outside interface. You can subnetted the this way: between your router & your ISP. The ISP router, the one in his central office, can use (probably already that) and you can configure for your router. You must advice your ISP about the address (.2) interfacing their router, namely the next hop toward you. for the segment between your router & firewall. The firewall can use (compatible with your MX record) and .6 for the inside port of your router.

Then, it leaves up to .31 for anything else.

If you need more help, don't hesitate.