?
Solved

Multiple PIX with Access-list

Posted on 2006-06-28
5
Medium Priority
?
240 Views
Last Modified: 2010-08-05
Hi Guys,

Here is the scenario


                              DMZ                        Private
Internet--------PIX1------------------PIX2----------
all the hosts on DMZ have the PIX2 As gateway
PIX1 will allow access to Internet from DMZ
PIX2 has Deny any any on DMZ internface
PIX2 has route as follows
0000 0000 PIX1 gateway.
Now a host on DMZ wants to access Internet, Do i need to allow access on PIX2

The host traffic will hit the PIX2 DMZ interface then the default route will direct to PIX1.
to do this does the PIX2 need to have the access-rule????? or will it forward it without accessrule??
However there is a default deny any any on DMZ interface of PIX2

regards
Naren
0
Comment
Question by:r_naren22atyahoo
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 17008103
You have to change the default gateway to PIX1
PIX2 will not redirect the traffic regardless of acls or rules.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 17008116
As long as you are natting between PIX2 and the DMZ there are no other routes needed on the hosts.
If you are not natting between them and all nat is on PIX1, then you need an additional route statement on the dmz hosts for the private lan IP pointing to PIX2
0
 
LVL 12

Author Comment

by:r_naren22atyahoo
ID: 17008216
Why?

If the Hosts on DMZ has PIX2 intf as the gateway.

then

the dmz hosts traffic comes to PIX2,
 if the traffice is fors private then it will direct to private, then if the traffic is for internet then
the default route on PIX2 i.e. 0000 0000 any to DMZ1 Intf of PIX1
will direct to PIX1 interface rite???

what exactly is wrong in the above scenario???
anyway the NAT is only on PIX1
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 17008299
What's wrong is the basic design principles of the pix. It will not redirect any packet out the same interface it arrived on. It will proccess it through to another interface without problem. A router would "bounce" it to the designated gateway in its route table. A PIX is not a router and does not behave the same way. A router will also send an icmp redirect to the host saying "that route is at gateway xxxx" and this creates a dynamic route table on the host so that next packets go directly to the alternate gateway. Pix will not send this redirect packet either.

With NAT only on PIX1 then you will have to add static route entries on the hosts for lan subnet behind pix2 and default gateway to pix1


0
 
LVL 11

Expert Comment

by:prueconsulting
ID: 17012902
Throw a layer 3 switch or router in the DMZ and allow it to make your routing descions and direct accordingly if you want to have those machines point to a single GW.  Point them at the switch
0

Featured Post

Get real performance insights from real users

Key features:
- Total Pages Views and Load times
- Top Pages Viewed and Load Times
- Real Time Site Page Build Performance
- Users’ Browser and Platform Performance
- Geographic User Breakdown
- And more

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Let’s face it: one of the reasons your organization chose a SaaS solution (whether Microsoft Dynamics 365, Netsuite or SAP) is that it is subscription-based. The upkeep is done. Or so you think.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses
Course of the Month13 days, 17 hours left to enroll

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question