Configure Public IP Subnet Inside the PIX

I don't think I understand what you are saying there.

... two distinct subnets on the same wire, but they haven't changed routing tables on their side...

How *has* the ISP set this up? They have two different gateway addresses listening for you on the same wire, but they have not set up the routing to send the second .240 via the first PIX's public IP? Is that what you mean?

If so then I don't see what the bit is about same broadcast domain??

If you are being sent two disjoint subnets on the same wire, then just hook both PIX eth0 and eth5 to the Cat 2950, and assign the outside interface for the 2950 to be "your end" of the IP address for the .240. static the public IPs to themselves on eth5, or nat 0 (without access list) them. Then do NOT have an inside interface that has those public IPs: instead, -route- those IPs to an interior router, with the interior router talking to one of the PIX interfaces via a shared private IP space. This in order to get around the difficulties of the PIX in having two interfaces in the same IP range. (The rules about that change in PIX 7; as I recall you are still using PIX 6.)

The other alternatives I can think of at this time of night involve NAT of the source IP if it is public traffic (rather than being strictly limited in source IP); you indicate that won't work for the new IPs but the implication is that it might work for the old IPs.

I cannot recall at the moment whether the 2950 is able to classify traffic into VLANs according to its layer 3 IP address. If it is, or if the two different subnets are coming in via different wires that both happen to terminate on the 2950, then you gain additional options.

Hi Walter,

See > >

Yes.

Since the Cat5 from the ISP terminates into the Cat 2950 (VLAN4 - Not related to a PIX VLAN) - If I put the server on that VLAN4, it won't route through the PIX, but be on that same (broadcast domain).

Could I split the second .240 to allow for my own routing?