Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Routing between a Pix and Internet Router

Setup for outside VLAN:

1. Pix outside interface IP address 192.168.1.1

2. Internet router e0/0 - 192.168.1.3

3. default route on Pix - 0.0.0.0. 0.0.0.0 192.168.1.3

4. default route on Internet router - 0.0.0.0. 0.0.0.0 <next hop to ISP>

I do not have a route that points to the Pix for Inbound traffic.

2 questions:

1. Without a route back to the Pix on my Internet router for inbound traffic, how does the router know how to send it to the Pix?

2. Will this scenario work?

a. Internet router - 192.168.1.3

b. Outside Pix 1 interface - 192.168.1.1

c. Outside Pix 2 interface - 192.168.1.2

2 pix firewalls on the same outside subnet as my Internet router. If I have a a 192.168.1.0/27 subnet and I have the following statics:

Pix 1 - Static (inside,outside) 192.168.1.4 10.1.1.1 netmask 255.255.255.255 (Inside Lan 1)

Pix 2 - Static (inside,outside) 192.168.1.5 172.16.1.1 netmask 255.255.255.255 (Inside Lan 2)

Is it possible to route two different static translations from the same subnet on the outside from the same Internet router to 2 different LANs behind 2 different Pixes? If not, does anyone have another suggestion?

Thanks,

RJ

  • Other Security Subjects
2 REPLIES

Re: Routing between a Pix and Internet Router

1. It will work if you are using NAT or a static map for your internal IPs and the translated IP will be on the 192.168.1.x subnet (and then the router has that route -directly connectd). If the NAT IP were on a different subnet, it would fail.

2. Yes it is possible to have that scenario, as the 2 PIXs will only answer/translate to the IPs it knows about. As long as the 2 PIXs don't have the same translation rules (both would answer for the same destination), you are fine. They wouldn't know about each other or care.

An alternative to this, and one that increases redundancy, is to have the PIXs in failover and have all rules in the same place (downside is you need failover licence and more interfaces - 2 per subnet).

Hope it helps.

Steve

New Member

Re: Routing between a Pix and Internet Router

Yes, thanks for the info.

183
Views
5
Helpful
2
Replies
This widget could not be displayed.