PIX-501 with multiple outside IP ranges

Have a question or want to start a discussion? Post it! No Registration Necessary.  Now with pictures!

Threaded View


My company has a PIX-501 in place as a firewall for a few computers in
co-location facilities.

It's currently routing traffic for our current set of IP's just fine, but
we're adding a second block, which is not contiguous with the first.

Is it possible to give the PIX two outside IP addresses (i.e. the first one
in each IP range)?

If not, what are my options?  Is it possible to use something akin to
promiscuous mode, so that all incoming packets are routed to the appropriate
internal address based on 'static (inside,outside)' statements?


--
 - Mike

Remove 'spambegone.net' and reverse to send e-mail.




Re: PIX-501 with multiple outside IP ranges


:Is it possible to give the PIX two outside IP addresses

No.

:If not, what are my options?  Is it possible to use something akin to
:promiscuous mode, so that all incoming packets are routed to the appropriate
:internal address based on 'static (inside,outside)' statements?

Giving the PIX two outside IP addresses would mean that the
PIX *itself* would respond to pings on the two IPs and would
be able to terminate VPN tunnels on the two IPs. You cannot do that
on any PIX on a single [logical] interface. (With any 500 series
model except the 501 and 510, you can configure multiple logical
interfaces per physical interface, with the logical interfaces being
distinguished by VLAN tag.)

Fortunately for the purposes you have described, you do not need
the PIX *itself* to respond to multiple IPs: you only need the
PIX to be able to pass traffic -through- on behalf of multiple IP
ranges. And there's no problem with that. Just configure the
static, nat, and global statements the way you would normally,
ignoring the fact that that the public IPs are not in the same
subnet as the PIX's outside interface. The PIX will proxy ARP on
behalf of an indefinite number of public IP, and if proxy ARP
isn't suitable for your situation, just *route* the additional IP
ranges to the PIX outside IP.
--
   Will you ask your master if he wants to join my court at Camelot?!


Re: PIX-501 with multiple outside IP ranges


:Please follow the below mwntioned link:

Ummm? Those two links are about VLAN support on PIX. The OP
can't use VLANs on his PIX: the OP has a PIX 501, which does not
support VLANs in any publically released version.
--
Suppose there was a test you could take that would report whether
you had Free Will or were Pre-Destined. Would you take the test?


Site Timeline