Solved

Create DMZ with PIX 501

Posted on 2007-11-21
4
1,222 Views
Last Modified: 2008-02-01
I am trying to create a DMZ zone with PIX 501 firewall and a netgear switch. I have Verizon FIOS with one public IP address. The outside interface of the firewall is connected to FIOS demarc and the inside interface has a LAN address rabge of 192.168.1.x 255.255.255.0.
ip address outside 1.1.1.1 255.255.255.0
ip address inside 192.168.1.1 255.255.255.0
The Netgear switch (acctually it a wireless router but im only using as a switch) is connected to the firewall inside LAN port. The netgear IP range is 10.10.111.x 255.255.255.0. What i would like to do is have a web server on the Netgear (DMZ) switch with an IP address of 10.10.111.10.
0
Comment
Question by:Mikeyb19ave
  • 2
  • 2
4 Comments
 
LVL 25

Expert Comment

by:Cyclops3590
Comment Utility
First of all, I am extremely jealous of you that you have Verizon's FIOS available to you.

Second, as I'm sure you know the PIX 501 will only support one subnet on each interface.  If you don't need to use the wireless portion on the router, I'd turn it off, if you can.  Plug the wan port into the same subnet as the PIX inside interface, then move the web server to the switch (or inside of the netgear router) side.  Give the router a static IP.  Then forward the ports on the PIX to the router ip that for port 80/443.  Do the mapping on the netgear as well.  The only other option I can think of is swap the hosts around.  Put the web server in between teh pix and the router so you don't double NAT the static mapping, but double-NAT the clients.  If that works, then you can still use the wireless ability of the router if you wish.

I can't guarantee this will work as there is essentially a double-NAT happening here and I've never done that before.  However logically speaking that should.  If not, then you should either swap your 501 out for an ASA 5505 (can assign different ports to a different VLAN, then just need a second switch).  The 5505 route is the way I'd go personally.
0
 

Author Comment

by:Mikeyb19ave
Comment Utility
I have set this up just as you suggested... To test I have attached a laptop to the Netgear subnet... I am able to browse the internet and also able to ping host ip address's on the Pix subnet (192.168.1.x)...I am also able to ping the outside interface of the Netgear Roiuter (192.168.1.200) from the Pix Subnet... I am unable to ping or telnet via the port i opened for test (375) the inside subnet of the Netgear router (10.10.111.x)..  
0
 
LVL 25

Accepted Solution

by:
Cyclops3590 earned 250 total points
Comment Utility
first, I just want to verify which way you set up

Internet <--pix--> 192.168.1.0/24 <--netgear--> 10.10.111.024

also when you say "unable to ping or telnet via port i opened for test...", where are you pinging to.  You should be able to ping from the to the 192 network.  You most likely won't be able to ping from the 192 to 10 network.  However if you telnet to the port that is mapped, it should work.

However if you have your client behind the netgear, I would put the server on the 192 network and your clients behind the netgear
0
 

Author Comment

by:Mikeyb19ave
Comment Utility
ok... i see what your saying... it does work when the clients are behind the netgear... Thanks for help
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Suggested Solutions

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
From Cisco ASA version 8.3, the Network Address Translation (NAT) configuration has been completely redesigned and it may be helpful to have the syntax configuration for both at a glance. You may as well want to read official Cisco published AS…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now