Solved

Cisco PIX 515E - Routing on same interface

Posted on 2004-08-31
5
1,219 Views
Last Modified: 2008-02-07
I'd like to confirm that it's not possible to route in and out of a PIX on the same interface.  

The internal network IP range 10.7.4.0
The internal NIC on the PIX 515E is 10.7.4.1
Default gateway for all the internal clients is 10.7.4.1
On of the machines (10.7.4.21) on the internal network is set up as a RRAS server to link the 10.7.4.0 and 10.7.1.0 networks

Ideally, I'd like PIX to route 10.7.1.0 traffic to 10.7.4.21.

I've added the route to the PIX
I can ping any client on the 10.7.1.0 network from the PIX console - which confirms that the RRAS server is working correctly
I cannot ping any of the clients on 10.7.1.0 from a machine on the 10.7.4.0 network.
My research suggests that you cannot get the PIX to route the traffic in this way, but I wanted a 'second opinion'

Can I solve the problem by putting another interface card in to the PIX and using that instead of the RRAS server?
0
Comment
Question by:MarkNethercott
  • 2
  • 2
5 Comments
 
LVL 57

Assisted Solution

by:Pete Long
Pete Long earned 150 total points
ID: 11940038
you are correct you cannot route on a PIX, if you need to route you need to put a router next to it.

I made the same mistake
http://www.experts-exchange.com/Networking/Q_20920906.html

Pete
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 150 total points
ID: 11940833
>I'd like to confirm that it's not possible to route in and out of a PIX on the same interface
Confirmed.

You can setup the RRAS server as the internal default for all users, and have it point to the PIX as its default gateway. Microsoft never sold a router, so I don't rely much on a server OS to do my routing.

>Can I solve the problem by putting another interface card in to the PIX and using that instead of the RRAS server?
Not suggested. Unlike a router, PIX interfaces have security levels and you will create yourself a rules nightmare trying to route between security levels.

Any old router with just one interface will work for you as a 'router on a stick'

0
 
LVL 1

Accepted Solution

by:
irjeffb earned 200 total points
ID: 11941735
You are correct in that you cannot get packets to go into a PIX and then back out the same interface.

However, you can put another NIC in the PIX to create a third connected network (your first internal, your public, and now your second internal).  You can then set up whatever security you want for it to pass traffic between the two internal networks.

The statement that a PIX cannot route is not truly accurate.  Technically, if you connect both internal networks to different interfaces and configure the security to allow it, the PIX will route between the two networks.
0
 
LVL 1

Expert Comment

by:irjeffb
ID: 11941758
One other note:

You will need to verify that your PIX license allows three interfaces.  The license will state the maximum number of interfaces.  I'm not positive that you can even get them with less than 3, but you should check anyway.  Ours is licenses for 8, although we only have 3.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 11945426
ThanQ
0

Featured Post

Active Directory Webinar

We all know we need to protect and secure our privileges, but where to start? Join Experts Exchange and ManageEngine on Tuesday, April 11, 2017 10:00 AM PDT to learn how to track and secure privileged users in Active Directory.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question