Connect two PIX firewalls

Posted on 2006-06-17
Medium Priority
Last Modified: 2013-11-16
I have two networks in the same building.
Network one is on a ip and network two is on
I have a PIX 515 on the 10.64 net and a PIX 520 on the 10.247 net.
I am trying to connect to a exchange server at from
the network.  I have attempted to bridge the network via
server 2003.  The exchange server is also 2003.  I can ping inside
on the net to the ip of the bridge.  Outside
the city, I have several sites throughout the state, which cannot ping.
My current plan is to attempt to connect the two pix's together
(they are in the same server room) with a second interface in each
via a cross over cable.

Can anyone provide me with what my config should look like?
The pix's are running 4x software.
Question by:Heath Calhoun
  • 4
  • 4
LVL 32

Expert Comment

ID: 16928467
4x ? I would first suggest you to upgrade it to 6.3(5) because your configuration is going to involve a lot of nat exclusions and stuff like that. The most stable version is 6.3(5).

LVL 11

Expert Comment

ID: 16929736
And how are the Pix's configured in the way of

Outside Interface / Inside etc.. Can you provide a small context diagram

Author Comment

by:Heath Calhoun
ID: 16931007
No smartnet, so unfortunately we can't upgrade.
The last time I tried to upgrade to 5x, after leaving, we had to return to downgrade back to ver 4.  5x stopped the firewall from working.
Also, I have a bunch of conduits setup to work.  Unless they have changed, I don't like the fact that the firewall stops checking for matches
after it finds the first match in a access list.
Get Cisco Certified in IT Security

There’s a high demand for IT security experts and network administrators who can safeguard the data that individuals, corporations, and governments rely on every day. Pursue your B.S. in Network Operations and Security and gain the credentials you need for this high-growth field.


Author Comment

by:Heath Calhoun
ID: 16931035
Maybe this helps.
Pix 10.64 resides on a state dps network going through a dps firwall to get to the outside.
Pix 10.247 resides on the state its network to get out.
Both pix's are in the same computer room.

The 10.247.121.x pix route:
outside 1 OTHEr static
inside 1 CONNECT static
outside 10.247.0 1 CONNECT static

The 10.64.163.x pix
outside 1 OTHER static
inside 1 CONNECT static
outside 1 CONNECT static

Both firwalls connect ultimately to the state network and then to the internet.
The 10.64 pix goes through the dps network as well to get through their firewall
to the its network.  The 10.247 pix goes to the its network.
Both firewalls are in the same computer room and need to be tied together with
network cards via a crossover cable.

its network to its firewall, internet
dps network, to dps firewall
router, pix 10.64, switch.

its network to itsfirwall, internet
router, pix 10.247. switch
LVL 11

Expert Comment

ID: 16944775
Build a DMZ network in each on the same subnet .

Ie Pix 1 -
Pix 2 -

Point the Route on PIX 2 to put through
PIX 1 - route via

and then build approriate Acls to allow the traffic required.


Author Comment

by:Heath Calhoun
ID: 16948075
That would keep traffic seperate.
Will I need a static command and then a route?
Can you give me a config?  I've never built a dmz or route on a pix before.
LVL 11

Accepted Solution

prueconsulting earned 500 total points
ID: 16948274
The DMZ is just build using one of the other interfaces installed on the PIX.
You shouldnt require a static at all .

interface ethernet2 100full                                                    
nameif ethernet2 DMZ security50
ip address DMZ

example route commands are as follows

route DMZ 1
route DMZ 1

Author Comment

by:Heath Calhoun
ID: 16980867
Thanks prueconsulting.  That is basically what we did, except we used static.
LVL 11

Expert Comment

ID: 16982706
Glad to be of assistance

Featured Post

Become a Leader in Data Analytics

Gain the power to turn raw data into better business decisions and outcomes in your industry. Transform your career future by earning your MS in Data Analytics. WGU’s MSDA program curriculum features IT certifications from Oracle and SAS.  

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
On Feb. 28, Amazon’s Simple Storage Service (S3) went down after an employee issued the wrong command during a debugging exercise. Among those affected were big names like Netflix, Spotify and Expedia.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

607 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question