Solved

Cisco Pix 506E w/PIX 6.3 and Transit Lan?

Posted on 2003-10-22
3
431 Views
Last Modified: 2013-11-16
I am setting up a few CoLocated servers at a new ISP, and they have a network configuration I have never seen before.

I have been assigned two networks for connectivity.  The first network is called the "Transit LAN" and consists of 2 IP addresses and is used to communicate with the router.
The second network is called the "customer LAN" and is useable by the my machines.
I need to create a virtual interface on the outside interface of the 506E with the "Transit LAN" information in order to get the 506E online.

They provide examples of how this works with Linux, Windows, etc (and it works).

Basically, I need to have interface ethernet0 have 2 IP addresses, 1 for the IP address that will be the REAL IP and one that is on the transit LAN.

How can I make ethernet0 have a virtual IP address on a 506E with PIX 6.3?








0
Comment
Question by:rxchurch
  • 2
3 Comments
 
LVL 79

Expert Comment

by:lrmoore
Comment Utility
Use the transit LAN ip as your outside interface, and use the Customer LAN as your NAT pool/static NAT addresses. That's all you really have to do.

Unless I mis-read the issue and you have both a router and a PIX.
In that case the "transit" LAN IP goes on the 'wan' interface of the router, the Customer LAN goes on the inside router interface, and the outside PIX interface, and the remainder is used as NAT Pool/static nat...

Use a private IP address space on the inside of the PIX

You can't do "virtual" interfaces or secondary addressing on the PIX
0
 

Author Comment

by:rxchurch
Comment Utility
Thanks lrmoore.  You didn't read it incorrectly, I don't have a router.

This did get me connectivity for my LAN, but introduced a new problem.

What I didn't mention is that the "Transit" IP is not "useable" by us.  My ISP filters all TCP/UDP connections to this "Transit" IP at the router, but they allow ICMP for monitoring.
 So now I can ping the Transit IP, but I can't get an ssh connection.

Or more importantly, a VPN connection.

Any clue as how I can fix this problem?

0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
Comment Utility
OK. So the problem is that you need to remotely manage this PIX, and with the transit IP assigned to the external interface, you can't access it.
I suppose you can't VPN to it either....
Solution 1 - put a router in front of it....this way you actually go "through" the "transit" LAN and connect directly to the PIX interface with a Customer LAN IP...
Solution 2 - convince the ISP to provide SSH/HTTPS access to that IP
Solution 3 - use static NAT map to a server on the inside, use Terminal services to connect to the server, then use the server to connect to the inside IP of the PIX..

PIX just doesn't behave the same as a router, so no additional IP addresses, no virtual (loopback) addresses, and you can't connect to the internal interface from outside... options are limited..
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Cisco Pix/ASA hairpinning The term, hairpinning, comes from the fact that the traffic comes from one source into a router or similar device, makes a U-turn, and goes back the same way it came. Visualize this and you will see something that looks …
Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now