1. Home
  2. Cisco Systems
  3. Two ISP - One Router - 1 PIX

Two ISP - One Router - 1 PIX

Hi,

Presently I have a setup like this ... We have 3600 Internal Router1 which is connected a switch1 and a PIX Firewall whose inside interface is connected to the same switch1, and the outside interface of PIX is directly connected to the ISP1. We have got 32 IPs from the ISP1 and we have setup PAT, NAT and Static NaT.

Now we are planning to have another link from a different ISP2. I have three ethernet ports on my PIX 515e firewall. already the outside and inside are used and left is third port which i wanted to make use as second outside port for the ISP2 and setup it up in such way that i get redundant links, failover capalities.

Can any one of you give me you valuable suggestions and steps in order to acheive this.

Thanks Srini

Reply to
s.pedhiti
Loading thread data ...

hi

i thing you dont work with pix to this topology. but if a router connect to all ISP(ISP1, ISP2, etc.) and it run OSPF on it (router will be "access router"), your links with redundent. on the PIX's default gateway is router ethernet interface.

(ISP)----|------->router-----PIX--------switch (ISP)----|

regards.

snipped-for-privacy@gmail.com yazdi:

Reply to
-

Please don't top-post. It makes the conversation harder to follow, and I have to manually edit the flow in order to produce a coherent discussion. Also, please only quote selected portions of the posting you are replying, instead of quoting the entire posting.

That configuration has the difficulty that if the outside router fails or the single used PIX outside interface fails, then all connectivity is lost. Sometimes that is an acceptable risk and sometimes that is not an acceptable risk.

The configuration would also have to be carefully managed to ensure that the outside router was able to reliably detect that the ISP links had failed (and recovered.) That can be tricky, as it is possible (and happens often) that the physical link stays up but the link stops passing traffic.

Thirdly, that configuration is not able to deal gracefully with connections that are already in progress: if you do NOT change the return IP addresses when you switch between ISPs then rest of the Internet will not be able to return packets to addresses in the dead ISP's IP range; but if you DO change the return IP addresses when you switch between ISPs then all existing connection-based connections (e.g., TCP) are going to fail because of the IP mismatch.

I recommend that the OP read through the white papers at Vincent C. Jones' web site, networkingunlimited.com

Reply to
Walter Roberson

And in particular, the white paper "Multi-Homing--Connecting to Two ISPs" for a quick overview of the issues and solutions. Then do a search on "ping based routing" if you can't justify BGP.

Good luck and have fun!

Reply to
Vincent C Jones

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.