Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

how pix 7.0 loadbalances

Dear All,

can anybody explain me.. how pix 7.0 load balances connections..

lets take scenario..

pix-1

intenal interface -172.16.5.3

external inteface- 10.10.10.3

pix 2

intenal interface -172.16.5.4

external inteface- 10.10.10.4

now two pixes. internal interfaces connected to internal switch and external interfaces connected to external switch.. now how loadbalancing works here ????

Regards

Nataraj

4 REPLIES
Silver

Re: how pix 7.0 loadbalances

Hello Nataraj,

You need to take care of load-balacing in the network - half of your traffic needs to be pointed to 10.10.10.3 and other half should be pointed to 10.10.10.4 address and same thing goes for the external interface. Now question is how you can achive that ? For that you need to have a layer III device - a router on inside and outside, and you can configure policy routing or equal cost path on the router to load share the traffic.

On the PIX, you need to configure Active/Active FO with ASR turned on which will take care of the session information replication between the PIXen.

Please, let's know if you have any follow-up questions.

Thanks,

Mynul Hoda

CISSP, CCIE # 9159

Author: Cisco Network Security Troubleshooting -http://www.ciscopress.com/title/1587051893

New Member

Re: how pix 7.0 loadbalances

Hi,

I was actually trying to work on Active-Active configuration on a similar environment.. As you know in order to operate your 2 PIX units in multiple mode by configuring at least 2 contexts. The problem is that different security contexts cannot share some of the configurations like NATting and static tranlsation; this means that you wont be able to publish your DMZ public servers on the 2 contexts because Cisco is expecting you to configure 2 totally different subnets on each context. So, please be aware of that and take this into consideration.

Regards,

Haitham

Silver

Re: how pix 7.0 loadbalances

Hello Haitham,

If I understand the issue correctly, ASR (Asymmetric Routing Support) should take care of that issue as pointed out by my previous post and outlined in the following link:

http://www.cisco.com/en/US/products/ps6120/products_configuration_guide_chapter09186a008045247e.html#wp1096075

Thanks,

Mynul Hoda

CISSP, CCIE # 9159

Author: Cisco Network Security Troubleshooting Handbook -http://www.ciscopress.com/title/1587051893

New Member

Re: how pix 7.0 loadbalances

Hi Mynul,

I'm aware about the asymmetric support, but I'm here talking about the possibility of the different contexts (let's assume we've only 2) to support the same internal network. Suppose you've one internal subnet 10.10.10.0/24 and a DMZ with some public services with only one internet link... Now you want to publish your servers on the public network plus you want to configure Global translation for your internal network, what I'm sure of is that you'll get an error when configuring the same address trnslation on both contexts. This means that the Active-Active is designed for supporting different networks and not for the same internal network. Please correct me if I'm wrong.

Thanks,

Haitham

110
Views
0
Helpful
4
Replies
CreatePlease to create content