Solved

Your opinion about connecting 3 Cisco PIX 506e firewalls?

Posted on 2008-06-11
18
321 Views
Last Modified: 2010-04-09
I would like your opinion about connecting 3 Cisco PIX 506e firewalls. I have 3 offices which I would like to connect to eachother. This must be done by creating VPN's. The connections between the offcies are made by direct fiber connections (LAN-to-LAN, no routing, no internet access). Is it needed or recommended to use routers between those connections in front of the PIX firewalls. OR it is possible to give the 3 firewalls IP-addresses like 10.10.10.1  .2 and  .3, creating internal ranges at the 3 offices and use static routes. Is that possible? What do you recommend for this scenario?
0
Comment
Question by:traction
  • 6
  • 6
  • 4
  • +1
18 Comments
 
LVL 20

Expert Comment

by:RPPreacher
ID: 21763315
Static routes are fine.
0
 

Author Comment

by:traction
ID: 21763341
in fact the Cisco PIX is also a basic router isn't it? What do you think, Cisco PIX 506E or a Cisco 870 series router?
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 21763382
A PIX can do basic routing.  It is not a router.

Use a PIX if you need firewall services or VPN tunnels, otherwise a 870 will be fine.
0
Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

 

Author Comment

by:traction
ID: 21763435
Indeed, I need VPN tunnels and good, reliable security... PIX for me?
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 21763439
Yes.
0
 
LVL 5

Expert Comment

by:renill
ID: 21766437
You need to place the pix 's at your perimeter and try making  a vpn mesh for redundancy.
Pix can do static routing. configure site-to-site vpns on the pixes.

Renill
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 21768387
Anything else you need before closing this question?
0
 

Author Comment

by:traction
ID: 21768617
Yes... I'm talking about LAN-LAN connections which are already VLAN'ed by the provider, we are talking about a private LAN-LAN connection without internet access. Maybe it's better than to make use of simple routers and not a firewall, like the PIX.

0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 21768742
If it is a private l2l connection, VPN is unnecessary.  You may want to firewall if you are worried about isolating traffic from place to place.

I think the router (since no VPN) would be best.
0
 
LVL 7

Expert Comment

by:naughton
ID: 21774667
i'd also look at an ASA vs a PIX - the ASA provides traffic management capabilities also.  you can always plug a modem / router into the Appliance later if needed for vpn etc.

the PIX would also provide a higher level of security.
0
 

Author Comment

by:traction
ID: 21776561
When I just want to "connect" the locations by using static routes and no other special things, what do you all advice me to use for type of router?
0
 
LVL 7

Expert Comment

by:naughton
ID: 21776575
how many users per site?>  what type of traffic is being passed?

you could enable ripV2 so the router can learn about the routes, - vs static entries.  


0
 

Author Comment

by:traction
ID: 21776785
In fact only RDP-traffic, some print traffic and somewhat internet traffic, it's about 4 sites.

main site  (here are the servers located) (4 Mb LAN-LAN connection)
sub site  max. 10 users  (2 Mb LAN-LAN connection)
sub site  max. 10 users  (2 Mb LAN-LAN connection)  
sub site  max. 15 users  (2 Mb LAN-LAN connection)  

At the main site there already is an internet connection which have it's own seperate firewall for internet access.
0
 
LVL 20

Accepted Solution

by:
RPPreacher earned 250 total points
ID: 21777231
I'm sure the 870 that you mentioned would be fine.
0
 
LVL 7

Assisted Solution

by:naughton
naughton earned 250 total points
ID: 21783351
an 800 series should be fine.  i'd also look at combining it with websense to manage internet usage - ensure you use route maps on any static NAT entries to avoid problems with VPN traffic.
0
 

Author Comment

by:traction
ID: 21784634
what is websense? an additional product for an cisco 800? or an additional device?
0
 
LVL 7

Expert Comment

by:naughton
ID: 21784645
www.websense.com  its a software add on for the router / firewalls.

0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I found an issue or “bug” in the SonicOS platform (the firmware controlling SonicWALL security appliances) that has to do with renaming Default Service Objects, which then causes a portion of the system to become uncontrollable and unstable. BACK…
Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question