Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 532
  • Last Modified:

Pix and routes


have a question about pix and routing to other vlans.

I have a catalyst 3750 behind a pix 525. The catalyst has several vlans configured. The
pix is connected to vlan 110. I need to give an outside user access to another vlan ( vlan 120 ).
How do i get the outside user routed to the other vlan.  

vlan 110
vlan 120
1 Solution
Pete LongTechnical ConsultantCommented:
Firewalls cant route - you need to fire all traffic needing routing to a router (or a layer 3 switch if we are talking VLans)- using the "default route" command
Ofcourse you PIX can route. Every firewall that I work with can route and my experience on firewalls are netscreen, nokia(checkpoint), PIX, stonegate, Symantec, iptables
The question is what type of access you need for that user. And is you firewall connected with another interface to that VLAN?
martyboyAuthor Commented:
my inside interface is connected to the vlan switch. On that vlan switch a have 5 different lans configured. Now i need
and source from the outside to connect to my client vlan.

The answer is no, only interface connected to the switch is the inside interface.  After that i need to
route the traffic forward. The thing that i cant figure out is how to route the traffic after i setup the static command.
Maybe this wont work

Pete, the catalyst is a L3 device and is already routing traffic.
2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

If you placed a static route to the gateway that knows address it should work.
Are you sure your switch allows to route traffic on that port to access both vlans?
THe problem is not on your firewall but on your switch
martyboyAuthor Commented:
Thx bloem!

Actually everything was correct on the switch and pix. My static line on the pix
was wrong. When i reconfigured the static everything worked great.
Yes, it will work.
Do you have a static route on the PIX

 route inside 192.168.1.x  (X=switch vlan 110 IP address)

Do you have a default on the switch that points to the PIX?
  ip route 192.168.1.y  (Y=PIX inside IP)

Your welcome

Featured Post

The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now