Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Your opinion about connecting 3 Cisco PIX 506e firewalls?

Posted on 2008-06-11
18
Medium Priority
?
327 Views
Last Modified: 2010-04-09
I would like your opinion about connecting 3 Cisco PIX 506e firewalls. I have 3 offices which I would like to connect to eachother. This must be done by creating VPN's. The connections between the offcies are made by direct fiber connections (LAN-to-LAN, no routing, no internet access). Is it needed or recommended to use routers between those connections in front of the PIX firewalls. OR it is possible to give the 3 firewalls IP-addresses like 10.10.10.1  .2 and  .3, creating internal ranges at the 3 offices and use static routes. Is that possible? What do you recommend for this scenario?
0
Comment
Question by:Traction IT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 6
  • 4
  • +1
18 Comments
 
LVL 20

Expert Comment

by:RPPreacher
ID: 21763315
Static routes are fine.
0
 

Author Comment

by:Traction IT
ID: 21763341
in fact the Cisco PIX is also a basic router isn't it? What do you think, Cisco PIX 506E or a Cisco 870 series router?
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 21763382
A PIX can do basic routing.  It is not a router.

Use a PIX if you need firewall services or VPN tunnels, otherwise a 870 will be fine.
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 

Author Comment

by:Traction IT
ID: 21763435
Indeed, I need VPN tunnels and good, reliable security... PIX for me?
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 21763439
Yes.
0
 
LVL 5

Expert Comment

by:renill
ID: 21766437
You need to place the pix 's at your perimeter and try making  a vpn mesh for redundancy.
Pix can do static routing. configure site-to-site vpns on the pixes.

Renill
0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 21768387
Anything else you need before closing this question?
0
 

Author Comment

by:Traction IT
ID: 21768617
Yes... I'm talking about LAN-LAN connections which are already VLAN'ed by the provider, we are talking about a private LAN-LAN connection without internet access. Maybe it's better than to make use of simple routers and not a firewall, like the PIX.

0
 
LVL 20

Expert Comment

by:RPPreacher
ID: 21768742
If it is a private l2l connection, VPN is unnecessary.  You may want to firewall if you are worried about isolating traffic from place to place.

I think the router (since no VPN) would be best.
0
 
LVL 7

Expert Comment

by:naughton
ID: 21774667
i'd also look at an ASA vs a PIX - the ASA provides traffic management capabilities also.  you can always plug a modem / router into the Appliance later if needed for vpn etc.

the PIX would also provide a higher level of security.
0
 

Author Comment

by:Traction IT
ID: 21776561
When I just want to "connect" the locations by using static routes and no other special things, what do you all advice me to use for type of router?
0
 
LVL 7

Expert Comment

by:naughton
ID: 21776575
how many users per site?>  what type of traffic is being passed?

you could enable ripV2 so the router can learn about the routes, - vs static entries.  


0
 

Author Comment

by:Traction IT
ID: 21776785
In fact only RDP-traffic, some print traffic and somewhat internet traffic, it's about 4 sites.

main site  (here are the servers located) (4 Mb LAN-LAN connection)
sub site  max. 10 users  (2 Mb LAN-LAN connection)
sub site  max. 10 users  (2 Mb LAN-LAN connection)  
sub site  max. 15 users  (2 Mb LAN-LAN connection)  

At the main site there already is an internet connection which have it's own seperate firewall for internet access.
0
 
LVL 20

Accepted Solution

by:
RPPreacher earned 1000 total points
ID: 21777231
I'm sure the 870 that you mentioned would be fine.
0
 
LVL 7

Assisted Solution

by:naughton
naughton earned 1000 total points
ID: 21783351
an 800 series should be fine.  i'd also look at combining it with websense to manage internet usage - ensure you use route maps on any static NAT entries to avoid problems with VPN traffic.
0
 

Author Comment

by:Traction IT
ID: 21784634
what is websense? an additional product for an cisco 800? or an additional device?
0
 
LVL 7

Expert Comment

by:naughton
ID: 21784645
www.websense.com  its a software add on for the router / firewalls.

0

Featured Post

Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
Powerful tools can do wonders, but only in the right hands.  Nowhere is this more obvious than with the cloud.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question