cisco pix 515e

Posted on 2006-04-01
Last Modified: 2013-11-16
I need to know if my pix will support 2 ISPs, meaning if the primary ISP goes down the backup would take over, can this be done?
Question by:tstuardo
    LVL 19

    Accepted Solution

    Hi there

    not specifically with a pix.  Outbound traffic to the internet goes out the outside interface on a pix and this interface cannot terminate an internet connection - let alone 2 of them.  You can of course have 2 ISPs and a PIX inside, but the edge routers are what do the work.  ie.

      ISP 1                             ISP 2
    Edge router 1               Edge router 2
             Both sharing 1 ethernet address

    Have BGP between both routers and you have full failover for ISPs

    A simpler solution would be one edge router with 2 interfaces - one for each ISP.  In the event of one going down, you have the second connection to provide internet connectivity - as I said - a few ways of doing this.  But the pix does not care or know whether the ISPs circuit has gone down or not.  It has an ethernet connection to the edge router(s) and if the ISP link goes down, the pix won't know as the ethernet interface is still up.

    heop this helps
    LVL 79

    Assisted Solution

    Not with PIX by itself. I can only support one default gateway at a time.
    However, it really depends on your connections to the ISP(s).
    If you have, say, a T1 from ISPA and a T1 from ISPB, then I would assume you also have T1 Routers:

       ISPA               ISPB
         T1                  T1
       Router1          Router2
            |_ _ _______|
               PIX Outside

    With this scenario, you have several choices. You can use dynamic routing protocols such as OSPF so that both routers and the PIX talk to each other and they all 3 know which T1 is up/available. Your dilema here will be which ISP's public IP address space are you using on the PIX outside? You can't use both, so perhaps Router2 does a double-nat . . .

    If you have DSL or other ISP connections, or T1 and DSL then you have other problems that are not easy to overcome.   Can you better explain your external connections to your 2 ISP's ?

    There are many dual-WAN capable firewalls on the market. The PIX is not one of them.
    Linksys RV0x2 series
    Linksys RV082:


    Netgear FVS318

    Zyxel Zywall

    hot Brick - dual WAN

    Watchguard Firebox


    LVL 79

    Expert Comment

    LOL! Great minds think alike!
    LVL 19

    Expert Comment


    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    There are many useful and sometimes not well documented or forgotten IOS or ASA/PIX commands. See IPE article here , there was also one on PacketU and on Cisco Tips & Tricks. Below are my favorites. I give also a few most often used for Cisco IPS an…
    Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

    755 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    19 Experts available now in Live!

    Get 1:1 Help Now