Solved

Cisco 1801 and PIX 506E Deployment Suggestions/Recommendations

Posted on 2006-11-28
14
424 Views
Last Modified: 2013-11-29
Hi all.

We've recently purchased a 1801 and PIX 506E.  I've configured the router with several VLANs however I'm a little confused as to how to deploy the 506E based on page 4 of the installation guide.  The guide says deployment with a router should look something like this:

Network PCs -> Switch -> PIX 506E -> Router -> Internet

That being the case then I would need a PIX 506E for every VLAN, is that right? or is there a better way?

Cheers

Paul
0
Comment
Question by:DotNetRules
  • 5
  • 4
  • 3
14 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 18035453
What is your Internet feed? Is it T1? DSL? Ethernet?  What was your idea for purchasing both?
The PIX 506e can only support 2 vlans on either interface. If you have more than that, it may be time to rethink your network. What is the purpose of the VLAN's? Do they need to communicate between them? Do you have VOICE and Data vlans that can stay separated?
VLAN's are easy on the router using sub-interfaces, but if you're using this router as a T1 connector, then the PIX will be between the router and the vlan switch and now you need to think of perhaps a L3 switch inside that would only require one vlan connected to the PIX and will route between them without the pix ever seeing the vlan data or inter-vlan traffic.
0
 
LVL 5

Expert Comment

by:WGhen
ID: 18035915
Hi the diagram needs to look like this if you want multiple VLANs...

Network PCs -> Switch -> Router -> PIX 506E -> Router -> Internet

Note the second router inside the firewall.  It will allow (or deny as desired) communications between vlans.  The external router provides only routing and connection to the ISP.

WGhen
0
 

Author Comment

by:DotNetRules
ID: 18035985
We have a new internet feed called BDSL which is kind of like Ethernet (i think) as the modem is seen as a UNC type device.  Our telco recommended the hardware based on our requirements but they aren't offering any advice or support for the configuration (wish I knew that in advance).

All I know about the internet feed is that I don't need to configure anything on the UNC type device, I can simply plug in my notebook, set a static IP on the same subnet and I can browse the internet, no ISP settings required.  The ISP have provided me with a public static IP for the device.

Our requirements are:

1. We want to host a few applications on our internal IIS servers (ASP.Net, WebServices and .Net Remoting).
2. We want the ability to place priority on certain services.
3. I was told the application servers (IIS and SQL2005) should be on a separate VLAN.
4. Possibly VOIP down the track but this would relate to point 2.

I mentioned earlier we have several VLANs, well not really, I was experimenting a little.  We have around 30 client PC on our network and I thought it would be a good time to partition the LAN by department, so having the ability to support more than 2 VLANs is not important, more of a 'nice to have'.

Today I managed to connect the 1801 router to the UNC device, configured NAT to point to our internal servers and now I can view sites on our IIS server etc, again experimenting more than anything.

Hope this helps.


0
 
LVL 79

Expert Comment

by:lrmoore
ID: 18036010
With an Ethernet feed, there is little value in running both devices. For your applications, the PIX may be better suited of the two products. Assign the public IP to the outside interface of the PIX. The PDM GUI makes it quite simple to use the PIX.
It will also support a vlan interface to create your DMZ for your publicly accessible servers. The question for you is: Can your IIS and SQL server stand alone without requirement for being joined to the AD Domain? If yes, then a DMZ will work. If not, then you don't really need a DMZ or VLAN's. does your LAN Switch support VLAN's, too?

0
 

Author Comment

by:DotNetRules
ID: 18036018
I just remembered something....  The internet feed is 3Mb and we can take it to 6Mb, we may in a year or two bring another feed into the building and dedicate it to VOIP only and plug in another 1801 , again this was recommended by the telco and they also talked about binding the two feeds but I think not.

Cheers
0
 

Author Comment

by:DotNetRules
ID: 18036073
Irmoore,

Our LAN switch doesn't support VLANs.

Our IIS, SQL Servers and PCs are on the same LAN/subnet but I was told the servers should be on a different VLAN (does that sound correct?).

Would it be possible (ok practise) to do this:

Network PCs -> Switch(non vlan)  -> 1801 Router -> PIX 506E -> Internet
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 79

Accepted Solution

by:
lrmoore earned 250 total points
ID: 18036175
Sure, you can do that. You would need another switch between the 1801 and the PIX. This space between would be your DMZ where your servers can live. Not really a VLAN, but the same principle.

0
 
LVL 5

Expert Comment

by:WGhen
ID: 18036239
Yuh, you'd be building a physical lan segment then, instead of a Virtual Lan (VLAN).  The old way.

WGhen
0
 

Author Comment

by:DotNetRules
ID: 18036387
Ok based on that configuration, how about this...

On the 1801 create a couple of VLANs, setup some rules on the 506E to route traffic to the VLAN IP addresses on the 1801 as required.  Would that work?

0
 
LVL 5

Expert Comment

by:WGhen
ID: 18036568
Normally, the Pix forwards traffic inward on one interface on a common VLAN where a router then moves it to the right VLAN interface.  The router has a physical interface for each vlan.
Also the little diagrams above are conceptual, and need not be physically connected that way.  A switch with multiple VLANs becomes the center of the physical connections, and could go something like this...


Internal Devices <---vlan 5 ---->  |--------------------|
Internal Devices <---vlan 10 -->   | Switch <---->   | -- vlan 666 ---> External Router
Internal Router  <---vlan 1 ---->  |                         | -- vlan 666 ---> Pix
                                                 |______________|

The internal router routes VLANs 1,5 and 10.  Switch has ports for VLANs 1,5,10 and 666.  666 is not routed.

WGhen
0
 

Author Comment

by:DotNetRules
ID: 18036711
WGhen,

So in your diagram the switch could be my 1801?
0
 
LVL 5

Assisted Solution

by:WGhen
WGhen earned 250 total points
ID: 18037039
No, not unless you have a Layer 3 switch (with an internal router) which is certainly possible.  The Cisco 3750's can do that.  In my diagram, however you have two routers.  The 1801 presumably is outside the firewal.  Inside you either have an L3 switch, or as in the diagram, another router.

Below is the diagram of the "L3 switch" version of the physical layout.


Internal Devices <---vlan 5 ---->  |--------------------|
Internal Devices <---vlan 10 -->   | Router/Switch   | -- vlan 666 ---> External Router
                                                 |                         | -- vlan 666 ---> Pix
                                                 |______________|


Remember, with these physical layouts, you are getting the following conceptual layout (as described earlier in the thread):

Network PCs -> Switch -> Router -> PIX 506E -> Router -> Internet


WGhen


WGhen
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Let’s list some of the technologies that enable smooth teleworking. 
When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now