PIX 506 & routing

Hmmm, thought I covered this in a posting last week.

You probably cannot do -exactly- what you are asking in PIX 5 or PIX 6. That's because you cannot *route* selectively in PIX 5 or PIX 6 (except whatever you can manage with OSPF route-maps).

What you can do is static traffic to different locations. In PIX 5 through PIX 6.0, you can selectively static incoming traffic only according to the destination (higher security) IP.

Starting from PIX 6.1, you can also selectively static incoming traffic according to the destination protocol (TCP or UDP) and port together (individually specified -- no ranges or wildcard in that syntax.)

Starting from PIX 6.3, you can selectively static incoming traffic according to an ACL, which may specify protocol, source address, source port, destination address, destination port, icmp type .

formatting link

Be warned that static with an ACL is one of the lowest priority forms. Effectively if you use it, you must convert all of your other statics for that address into the ACL form. You cannot, for example, specify that you want,

access-list go4it permit tcp host 123.45.67.89 interface eq 3898 static (inside,outside) interface access-list go4it static (inside,outside) interface 10.0.0.1 netmask 255.255.255.255

because that plain static has higher priority than the other static, so the access-list will never be examined.