router config help

[rhltechie]

Hi All,

I have a situation where I will be using three ethernet int on my router. one fast int will be to my metro e internet connection, one fast int will be to my pix, and the third ethernet int will be for my ms isa server. i would like for the pix and the isa to have public ip addresses. i have an ip address on the fast int to the metro e obviously, i also have an ip address on the int to the pix. what about the third ether int? the public address for this isa server is on the same subnet as the public ip for the pix. must i have an ip on the ether int at all for it to function properly?

TIA,

R

[Edison Ortiz]

Ideally, you should setup a switch (DMZ switch) to host the PIX and ISA server LAN interface and connect one interface from the Router to this switch.

What's the reason you want to use 2 different interfaces sharing the same subnet ?

[rhltechie]

hmm...no specific reason to do this honestly, just never thought the switch idea was the way to go. So you are saying just put a small switch connected there to service both the pix and isa would be the way to go? is that secure?

[Edison Ortiz]

The switch approach enables you to place a workstation on the DMZ and take packet traces for troubleshooting purposes, among other things.

The switch doesn't need to have a routable IP, if you need to manage it, console to it.

[Georg Pauwen]

Hello,

you could use 'ip unnumbered FastEthernetX' on that third interface, where 'X' is the number of the interface where the PIX is connected. That would save you one IP address; what traffic are you directing to the ISA server though ?

Regards,

GP

[rhltechie]

the ip unnumberded actually does not work because neither is a serial (point to point int). I looked into that but found out in the docs that it cannot be a "multiaccess" interface.

The ISA server will be doing security of my OWA server as well as some email and web filtering.