Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Migration from ISA to PIX

Hi There,

I have a requirement to migrate from ISA FW to PIX and I need to check whether the PIX will provide me with what ISA is currently doing; the ISA is currently performing the following:

1- Outbound user authentication with LDAP; each user has a different access privilege to the internet (i.e. some have full-access while some others have only limited access).

2- Controlling access based on working hours.

3- I'm publishing different services with different paths using the same public IP (e.g.

www.example1.com/exchange x.x.x.1

www.example1.com/portal x.x.x.1)

where x.x.x.1 is the same public IP; the ISA FW will do the translation aacording to the full url path to the appropriate internal server private IP.

Can the points mentioned above be achieved with the PIX FW; I might still use the ISA as a proxy but no longer as a FW tier.

Thanking in advance.

Regrds,

Haitham

4 REPLIES

Re: Migration from ISA to PIX

1. Sort of. You can make the PIX authenticate all out going access. Not sure that it will do exactly what you want.

2. You can do time-based ACLs in v7.

3. No, it won't do URL redirection. You'd need a content switch for that.

Could you put the ISA inline inside the PIX, and let the PIX just do firewalling ?

New Member

Re: Migration from ISA to PIX

Hi,

It's not an option to keep the ISA inline unless there's no other choice. Regarding point# 2; will the PIX be able to do time-based ACL based on username (authenticated through LDAP) or it will just apply the rules to all the users?

Thanks,

Haitham

Re: Migration from ISA to PIX

Normally time based ACL is for all users, but perhaps you could do something with downloadable ACLs from an Cisco ACS server. The ACS would check AD and map users into groups, the groups could have downloadable time-based ACLs.

PIX alone wil not do what you want, but I think perhaps adding an ACS would do.

New Member

Re: Migration from ISA to PIX

Hi,

I verified this and LDAP group-based authorization is doable using downloadable ACL but either through a RADIUS server like Interent Authentication Service (IAS) or through Cisco ACS.

This also is applicable to VPN access.

Thanks,

Haitham

112
Views
4
Helpful
4
Replies