Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Cisco Pix 506E w/PIX 6.3 and Transit Lan?

Posted on 2003-10-22
3
434 Views
Last Modified: 2013-11-16
I am setting up a few CoLocated servers at a new ISP, and they have a network configuration I have never seen before.

I have been assigned two networks for connectivity.  The first network is called the "Transit LAN" and consists of 2 IP addresses and is used to communicate with the router.
The second network is called the "customer LAN" and is useable by the my machines.
I need to create a virtual interface on the outside interface of the 506E with the "Transit LAN" information in order to get the 506E online.

They provide examples of how this works with Linux, Windows, etc (and it works).

Basically, I need to have interface ethernet0 have 2 IP addresses, 1 for the IP address that will be the REAL IP and one that is on the transit LAN.

How can I make ethernet0 have a virtual IP address on a 506E with PIX 6.3?








0
Comment
Question by:rxchurch
  • 2
3 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 9609125
Use the transit LAN ip as your outside interface, and use the Customer LAN as your NAT pool/static NAT addresses. That's all you really have to do.

Unless I mis-read the issue and you have both a router and a PIX.
In that case the "transit" LAN IP goes on the 'wan' interface of the router, the Customer LAN goes on the inside router interface, and the outside PIX interface, and the remainder is used as NAT Pool/static nat...

Use a private IP address space on the inside of the PIX

You can't do "virtual" interfaces or secondary addressing on the PIX
0
 

Author Comment

by:rxchurch
ID: 9615453
Thanks lrmoore.  You didn't read it incorrectly, I don't have a router.

This did get me connectivity for my LAN, but introduced a new problem.

What I didn't mention is that the "Transit" IP is not "useable" by us.  My ISP filters all TCP/UDP connections to this "Transit" IP at the router, but they allow ICMP for monitoring.
 So now I can ping the Transit IP, but I can't get an ssh connection.

Or more importantly, a VPN connection.

Any clue as how I can fix this problem?

0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 9616232
OK. So the problem is that you need to remotely manage this PIX, and with the transit IP assigned to the external interface, you can't access it.
I suppose you can't VPN to it either....
Solution 1 - put a router in front of it....this way you actually go "through" the "transit" LAN and connect directly to the PIX interface with a Customer LAN IP...
Solution 2 - convince the ISP to provide SSH/HTTPS access to that IP
Solution 3 - use static NAT map to a server on the inside, use Terminal services to connect to the server, then use the server to connect to the inside IP of the PIX..

PIX just doesn't behave the same as a router, so no additional IP addresses, no virtual (loopback) addresses, and you can't connect to the internal interface from outside... options are limited..
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article assumes you have at least one Cisco ASA or PIX configured with working internet and a non-dynamic, public, address on the outside interface. If you need instructions on how to enable your device for internet, or basic configuration info…
This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question