Multiple Outside Interfaces

[dhorsey]

Just trying to figure out if this scenario will work.

I would like to setup two ouside interfaces and two DMZ's on my pix firewall. ie. each outside interface will be attached to different routers connected to the Internet.

Traffic will not need to be routed between the two networks. ie outside interface 1 will send traffic to dmz1 and outside interface 2 will send traffic to dmz 2

If this will work, how do I setup the route command?

Would this work?

route outside1 "dmz1 ip's" "dmz1 subnet" "router1 ip" 1

route outside2 "dmz2 ip's" "dmz2 subnet" "router2 ip" 1

Thanks for the help!

Dave

[rrbleeker]

No, this will not work. The PIX looks at the destination IP address to determine where to send a packet to and not the next-hop address. If you send traffic from an DMZ interface to an destination on the Internet, the pix will use its default gateway, unless you have a static route for that destination.

[ajd]

Look in the Cisco Press book, Managing Cisco Network Security, there are multiple instances of dual 'provider' networks with no default route.

Also, look into Policy Based Routing/Route Maps and perhaps looking again at your topology.

-ne1secure?