Solved

Need to do static routing in Pix 501 - How to do?

Posted on 2008-06-22
11
916 Views
Last Modified: 2012-06-27
I'm a beginner in Pix 501. Don't know how to setup routing.

Can anyone tell me how to do it in PDM?
0
Comment
Question by:TANGLAD
  • 6
  • 5
11 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 21844826
What routing do you want to do? A 501 will be version 6 at best so its routing capability is very limited.

0
 
LVL 1

Author Comment

by:TANGLAD
ID: 21844986
Our default gateway for the PC's is our firewall and internetconnection 192.168.22.254 (that is the lan address of our firewall.

We have an MPLS for connecting our office to our HQ. That MPLS router is connected to our LAN on address 192.168.22.78

So we need to do some routing in the Pix 510 for some specific nets/hosts on our HQ

HQ has asked me to do this routing in our firewall:

ip route xxx.xxx.xxx.0 255.255.255.0 192.168.22.78

How to do this in Pix PDM (the xxx.xxx.xxx.0 is because I don't want to tell the real network ip)
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 21845038
ok so 192.168.22.254 is the inside of the PIX
HQ Link is inside and its 192.168.22.78

>>How to do this in Pix PDM (the xxx.xxx.xxx.0 is because I don't want to tell the real network ip)

I understand your need for security but - this netrwork should be a private IP address range not a public one?

Does HQ get its internet connection through you? what needs routing back to them?
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 1

Author Comment

by:TANGLAD
ID: 21845159
No HQ does not get Internet connection through us.

They have set up the new MPLS on 192.168.22.78 so we can run applications on their servers. When the routing is ok, we can do DNS and trusts and so on, but first we need the routing, and that is what I need your help for.

0
 
LVL 1

Author Comment

by:TANGLAD
ID: 21845223
In other words:

When a pc needs to contact the application server in HQ at address 193.210.88.50 our default gateway (the Pix 510 at 192.168.22.254) should route the trafic to 192.168.22.78 (the MPLS router)

Thats it - how to do that in Pix PDM (if possible at all)
0
 
LVL 57

Accepted Solution

by:
Pete Long earned 500 total points
ID: 21845417
OK Im with you - sorry Im a bit slow :)

This wont work, the PIX 501 will not dynamically route traffic back again - you need to do one of the following

Option 1: If you have a Windows server at your site intall RRAS on it and set it up as a router - make that your clients default gateway 192.168.22.254 then change the inside IP of the PIX to something else, then add the routing on the RRAS Server.

Option 2: If you have a layer 3 switch get that to do some LAN rouing at your site and make that 192.168.22.254

Option 3: But a router and put it on your site.
0
 
LVL 1

Author Comment

by:TANGLAD
ID: 21845477
Do you agree that another option is creating persistent routes on the PC's wil work for this setup?
0
 
LVL 1

Author Comment

by:TANGLAD
ID: 21845489
In Pix PDM on System Properties/Routing/Static Routing I can setup routing entries? Will that not work?
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 21847290
>>Do you agree that another option is creating persistent routes on the PC's wil work for this setup?

Yes thought thats a bit of a mess about, and you will need to remomber to add it to the new machines as you buy tem or farm it out by login script

route add xxx.xxx.xxx.0 mask 255.255.255.0 192.168.22.78 -p

>> In Pix PDM on System Properties/Routing/Static Routing I can setup routing entries? Will that not work?

No the PIX will not intelligently route traffic, you can add default routes per interface and assign metrics to those routes - or the firewall very loosley will support RIP routing but it wont make routing decisions for you.
0
 
LVL 1

Author Comment

by:TANGLAD
ID: 21853433
Tested and you are absoloutely right. Of course.

We changed the default gateway in the dhcp scope so the gateway is now the router for the HQ link 192.168.22.78 and now it works, and Internet access works too.

So we don't need the Pix 501 routing anyway.

Thanks so much.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 21865088
No Probs glad you got there :)
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Some help with Network Design 4 50
Power Supply for Linksys Wireless-G Internet Home Monitoring Camera 2 35
Guest Wi-Fi Time out 3 26
Cisco Router Security Commands. 2 30
Cisco Pix/ASA hairpinning The term, hairpinning, comes from the fact that the traffic comes from one source into a router or similar device, makes a U-turn, and goes back the same way it came. Visualize this and you will see something that looks …
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

789 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question