We have 3 dsl line of 2 mbps each with public ip assigned. I want to go for PIX firewall, Can i use all 3 wan connection simutaneously with PIX firewall, if yes then how. Any alternate thr?. also guide me cheapest pix version to use as firewall with all 3 wan connection.
Global (dsl_line) 1 x.x.x.10-x.x.x.20 netmask 255.255.255.128
Global (net1) 1 y.y.y.40-x.x.x.50 netmask 255.255.255.192
Global (net2) 1 z.z.z.20-z.z.z.30 netmask 255.255.255.224
route outside 0.0.0.0 0.0.0.0 x.x.x.1 1*
route outside 0.0.0.0 0.0.0.0 y.y.y.1 2*
route outside 0.0.0.0 0.0.0.0 z.z.z.1 3*
*PIX only accept one (1) static route with metric 1 at any time. Therefore, you need to assign priority, e.g link #1 metric 1, link 2 mteric 2 and so on, to the default route to all 3 links. PIX does not have smart routing feature like router.
But since all your internal hosts are connected directly to PIX inside interface, and need to use all 3 links to go out anywhere they want, users need to add 3 gateways in their machines, which is not really recommended due to problem with Microsoft. You can always add 2 more IPs as gateway, but host will keep looking/using the 1st gateway in the list.
You cannot use route-map in PIX as it is used to redistribute routes from one routing protocol into another, not to specify preferred route.
You probably need to specify specific range of target/external addresses/subnets in the static route to enable internal hosts accessing specific external/internet address via specific link. In this case, you dont need to specify the metric.
Thanx AK, u r very close to my solution. let me tell u that we r using win98 at end user would it be ok to access all 3 network with 98 using 3 gateways. my network are 23.125.12.* , 192.168.2.*, 78.561.25.*.With out a router can we implement this using PIX only. would it work ?
I am sure it will work, except the fact that you cannot maximize the 3 links for your internet browsing or accessing external network activities.
Internet access will go mainly via Link#1 as it has highest metric or priority. The other 2 links will probably do nothing until Link#1 down.
***But again, there might be an issue as PIX will not know/aware (not intelligence) if Link#1 is down. This will make it to keep pushing/sending traffic out through that link. That's why a router is needed. But you can always use Link#2 & Link#3 for for specific traffic, e.g use Link#2 for email traffic, Link#3 for DNS and so on.
Alternatively, if you want, you can try this (attach config) theory, although this is still subjected to the above *** statement. The execption is each internal address/subnet will use specific link to go out/to internet.
For PIX OS, if possible, use the latest 6.x version.
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...