We have two private line T-1s coming in from customers that directly connect to our network and we decided we needed to put a firewall up between their networks and ours even though there is no public traffic traversing any of these connections. The two Ts land on a 25XX that connect to our 506E which then connects to another 25XX that is inside our network. All NATing is disabled so that connectivity to remote servers can still be reached. We thought we had everything in place but when telneting in to some of our remote sites inside our network and then pinging out from them the ping died at the inside of the pix, but we could ping to those sites from the outside of the network/pix. (Since I'm not on site and this has to be an off-hours installation it has limited my window of opportunity to work on this project). I think I have the problem figured out but wanted to see if I could get some feedback here?
25XX on the outside
25XX on the inside
Remote site routers all connected via EIGRP to the 25XX
And have it read 172.20.0.0 leaving out the 51 block since when pinging the remote routers 172 network dies at the pix since it isn't in the 172.20.51.0 network?
My other question is why I had to put route outside commands in to the PIX instead of just using the default route out? Before I put those commands in to the pix we could not ping out past the EO connected to the outside int on the pix.
Before i go back out to implement I wanted to get some sort of feedback re this problem.
Technically I don't understand why you need to put a PIX in place. Since the PIX is not required to perform any specific Firewall or VPN features according to your description. If you only require ACL or maybe route filter function, your existing routers are already able to achieve.
BTW, if you are not using NAT, you can use NAT 0 command. You are using access-group with access-list "cmh-csm" but not being defined. I don't quite get you are not trying to perform with your routing defined.
BenefitsDocumentationPrerequisiteImage Download LinksLimitationsSupported PlatformsLicense RequirementsTopologyStep-By-Step ConfigurationConfigure Virtual ServiceActivate the virtual service and configure guest IPsConfiguring UTD (Service Plane)Configurin...
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...