1. Home
  2. Cisco Systems
  3. How good are 800 series with 2 ethernets available? PIX IPsec.

How good are 800 series with 2 ethernets available? PIX IPsec.

Hi all,

I MUST have a PIX with 2 interface on the same subnet (32 address) where to terminate VPNs tunnels. I need them for the traffic to flow between those 2 interfaces. PIX runs 6.3(4) and it is not possible to have 2 interfaces belonging to the same addressing range and same subnet mask. My idea was to put a router in the middle for one of the 2 interface. I had at the office a 837. I upgraded it to IOS 12.4 (that is the key!) to have

2 Ethernet interfaces independently configurable.

The configuration is reported below

------ | |-tunn2---e2-|837(12.4)|-e0---Internet---|2611(12.3.15)|----10.134.36.0/24 | |

-192.168.36.0/24--inside---| |--outside-------- | | | |-tunn1------------------------Internet ------

837 must forward IPsec traffic from public IP to the internal IP address of the PIX.

I don't want to upgrade to 7.0, perhaps in the future. I want to read deeply infos about migration from 6.3.4 to 7.0 before moving to new version.

I have another interface where VPN tunnels terminate, named tunn1 (as you can see).

As all of that I explained works fine but sometime tunnel between 192.168.36.0 and 10.134.36.0 goes down, my question is

is 837 enough good to play that role? I tried it because I had it at the office.

Could a 831 be good to play that role? Or must I choose higher level products? For me 837 should be good enough for that purpose but who knows?

Thanks for all your comments and/or suggestions.

Alex.

Reply to
AM
Loading thread data ...

AM schrieb:

The 831 would be a better choice, you'll have 3 Ethenert interface, and between E1 and E0 you'll have full throughput.

If the 837 does not encrypt/decrypt IPsec traffic, even a Soho91 or 806 will do the job. No hardware 3des, no IPv6, no managed switch, no IPS, no BGP.

Reply to
Uli Link

So why not an 837 with IOS capability? Where is the limit I can not see on using an 837 (aside it has too features to be used only for the router 2 ethernet Interfaces). My question is:

as, for me, the 837 is a critical point of the chain, should also all the products belonging to 800 series not enough good for my purposes? Againg shouldn't 837 good enough? Or simply am I forgetting something?

Alex.

Reply to
AM

AM schrieb:

Limited throughput between E0 and E2. E2 isn't a real Ethernet interface.

Reply to
Uli Link

How can I know that? Apart doing throghuput test... perhaps is there a command?

Thanks, Alex.

Reply to
AM

AM schrieb:

sh controllers

From the Release notes of 12.3(7)XR, where this feature was introduced. "

formatting link
" That's why I think there are cheaper and better routers for your setup.

But if you have this 837 and it is fast enough, why not?

Reply to
Uli Link

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.