Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1113
  • Last Modified:

create a route for certain destination IP's on inside of PIX 515e

Hi,

I need your advice on this:

I have a local network (192.168.x.x) connecting to an ISP through a Cisco PIX515e (2 interfaces: inside and outside). This is working fine.

Now certain destination IP's need to be directed through a router on the local network (on the inside interface, I assume) .

How would I accomplish that? I would not like to change the local default gateway.

TIA

John
0
pworce
Asked:
pworce
1 Solution
 
Pete LongConsultantCommented:
Hello John, Im usure of your problem

you want some internal hosts to go through a router before they get to the pix?

if so just make the routers IP address the default gateway for the clients, and make the gateway of last resort of the router the IP of the PIX (internal IP that is)

Pete
0
 
Pete LongConsultantCommented:
youve not got much choice. you CANNOT do routing with a pix firewall
0
 
Pete LongConsultantCommented:
if that dont answer the question, your gonna need to give me some more info :)
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
pworceAuthor Commented:
I don't want to change the default gateway on the clients. Some external (destination) IP's need to be directed to another router.

I can't believe this can't be done.
There is a route cmd (6-24 command reference).

please advice ...
0
 
Pete LongConsultantCommented:
Right I see

do this on one client to test

Start >run >cmd {enter}

route add <network number of DESTINATION NETWORK> mask <subnet mask of destination network> <ip address of the router> -p
0
 
pworceAuthor Commented:
Ok.

It did not find the gateway because it's on a class A network 10.x.x.x
0
 
Pete LongConsultantCommented:
?? doesnt matter? from command line execute a   route print and post the results here :)
0
 
pworceAuthor Commented:
C:\Documents and Settings\user>route print
===========================================================================
Interfacelist
0x1 ........................... MS TCP Loopback interface
0x2 ...00 50 8b a5 af 3f ...... Compaq NC3161 Fast Ethernet NIC - Pakketplanner-
miniport
===========================================================================
===========================================================================
Activ routes:
Networkaddress             Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.9.200.254    192.9.200.47       30
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.9.200.0    255.255.255.0     192.9.200.47    192.9.200.47       30
     192.9.200.47  255.255.255.255        127.0.0.1       127.0.0.1       30
    192.9.200.255  255.255.255.255     192.9.200.47    192.9.200.47       30
        224.0.0.0        240.0.0.0     192.9.200.47    192.9.200.47       30
  255.255.255.255  255.255.255.255     192.9.200.47    192.9.200.47       1
default-gateway:     192.9.200.254
===========================================================================
Static routes:
  none

C:\Documents and Settings\user>
0
 
Pete LongConsultantCommented:
OK heres me adding a 10. address to mine

C:\Documents and Settings\PeteLong>route add 10.2.2.0 mask 255.255.255.0 192.168.1.2 -p

C:\Documents and Settings\PeteLong>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 01 03 c1 55 27 ...... 3Com EtherLink XL 10/100 PCI For Complete PC Man
agement NIC (3C905C-TX) - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1   192.168.1.100       20
         10.2.2.0    255.255.255.0      192.168.1.2   192.168.1.100       1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0    192.168.1.100   192.168.1.100       20
    192.168.1.100  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255    192.168.1.100   192.168.1.100       20
        224.0.0.0        240.0.0.0    192.168.1.100   192.168.1.100       20
  255.255.255.255  255.255.255.255    192.168.1.100   192.168.1.100       1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
         10.2.2.0    255.255.255.0      192.168.1.2       1


Pete
0
 
lrmooreCommented:
If your PIX inside interface is 192.9.200.254  and it is the client's default gateway, adding a route statement on the PIX will not do you any good.

>I can't believe this can't be done.
Believe it. A PIX is NOT a router, it is a firewall. A firewall's job is to stop packets. A router's job is to forward packets.
A firewall will not re-direct a packet back out the same interface it came in on. If the source IP is on the inside interface, and you add a static route so that the destination IP is supposed to be re-directed to another host (router) on the inside interface, it just won't happen.

Either change the default gateway on the clients, or you will have to add  a static route to every client. If you forget to add the "-p" flag to make it permanent, the next time a client reboots, the route will be gone.

If this is a temporary setup, then you've created a lot of work for yourself.
If it is a permanent setup....
If you have any old router, you can use a "router on a stick" and use just one interface as the default gateway for your clients, and now you can forward any networks you want to wherever you want.
0
 
Pascal666Commented:
If they are external IPs, why are they on your inside network?  Put the router in a DMZ off your PIX and you will be able to route to it.

-Pascal
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now