Solved

create a route for certain destination IP's on inside of PIX 515e

Posted on 2004-03-29
11
1,078 Views
Last Modified: 2013-11-16
Hi,

I need your advice on this:

I have a local network (192.168.x.x) connecting to an ISP through a Cisco PIX515e (2 interfaces: inside and outside). This is working fine.

Now certain destination IP's need to be directed through a router on the local network (on the inside interface, I assume) .

How would I accomplish that? I would not like to change the local default gateway.

TIA

John
0
Comment
Question by:pworce
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
11 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 10704021
Hello John, Im usure of your problem

you want some internal hosts to go through a router before they get to the pix?

if so just make the routers IP address the default gateway for the clients, and make the gateway of last resort of the router the IP of the PIX (internal IP that is)

Pete
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 10704031
youve not got much choice. you CANNOT do routing with a pix firewall
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 10704036
if that dont answer the question, your gonna need to give me some more info :)
0
NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

 

Author Comment

by:pworce
ID: 10704127
I don't want to change the default gateway on the clients. Some external (destination) IP's need to be directed to another router.

I can't believe this can't be done.
There is a route cmd (6-24 command reference).

please advice ...
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 10704182
Right I see

do this on one client to test

Start >run >cmd {enter}

route add <network number of DESTINATION NETWORK> mask <subnet mask of destination network> <ip address of the router> -p
0
 

Author Comment

by:pworce
ID: 10704313
Ok.

It did not find the gateway because it's on a class A network 10.x.x.x
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 10704560
?? doesnt matter? from command line execute a   route print and post the results here :)
0
 

Author Comment

by:pworce
ID: 10704648
C:\Documents and Settings\user>route print
===========================================================================
Interfacelist
0x1 ........................... MS TCP Loopback interface
0x2 ...00 50 8b a5 af 3f ...... Compaq NC3161 Fast Ethernet NIC - Pakketplanner-
miniport
===========================================================================
===========================================================================
Activ routes:
Networkaddress             Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.9.200.254    192.9.200.47       30
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.9.200.0    255.255.255.0     192.9.200.47    192.9.200.47       30
     192.9.200.47  255.255.255.255        127.0.0.1       127.0.0.1       30
    192.9.200.255  255.255.255.255     192.9.200.47    192.9.200.47       30
        224.0.0.0        240.0.0.0     192.9.200.47    192.9.200.47       30
  255.255.255.255  255.255.255.255     192.9.200.47    192.9.200.47       1
default-gateway:     192.9.200.254
===========================================================================
Static routes:
  none

C:\Documents and Settings\user>
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 10704753
OK heres me adding a 10. address to mine

C:\Documents and Settings\PeteLong>route add 10.2.2.0 mask 255.255.255.0 192.168.1.2 -p

C:\Documents and Settings\PeteLong>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 01 03 c1 55 27 ...... 3Com EtherLink XL 10/100 PCI For Complete PC Man
agement NIC (3C905C-TX) - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1   192.168.1.100       20
         10.2.2.0    255.255.255.0      192.168.1.2   192.168.1.100       1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0    192.168.1.100   192.168.1.100       20
    192.168.1.100  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255    192.168.1.100   192.168.1.100       20
        224.0.0.0        240.0.0.0    192.168.1.100   192.168.1.100       20
  255.255.255.255  255.255.255.255    192.168.1.100   192.168.1.100       1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
         10.2.2.0    255.255.255.0      192.168.1.2       1


Pete
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 200 total points
ID: 10705591
If your PIX inside interface is 192.9.200.254  and it is the client's default gateway, adding a route statement on the PIX will not do you any good.

>I can't believe this can't be done.
Believe it. A PIX is NOT a router, it is a firewall. A firewall's job is to stop packets. A router's job is to forward packets.
A firewall will not re-direct a packet back out the same interface it came in on. If the source IP is on the inside interface, and you add a static route so that the destination IP is supposed to be re-directed to another host (router) on the inside interface, it just won't happen.

Either change the default gateway on the clients, or you will have to add  a static route to every client. If you forget to add the "-p" flag to make it permanent, the next time a client reboots, the route will be gone.

If this is a temporary setup, then you've created a lot of work for yourself.
If it is a permanent setup....
If you have any old router, you can use a "router on a stick" and use just one interface as the default gateway for your clients, and now you can forward any networks you want to wherever you want.
0
 
LVL 6

Expert Comment

by:Pascal666
ID: 10738854
If they are external IPs, why are they on your inside network?  Put the router in a DMZ off your PIX and you will be able to route to it.

-Pascal
0

Featured Post

Watch Anatomy of a Wi-Fi Hack On-Demand

In less than a weekend, anyone with Internet access and some free time can become a Wi-Fi MitM to wreak havoc on your network. View our Wi-Fi Expert in an on-demand episode of our Secure Wi-Fi mini-series as he explores the motives, execution, and anatomy of a Wi-Fi hack.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

735 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question