Solved

Two routes out of a PIX

Posted on 2008-10-20
8
260 Views
Last Modified: 2008-11-07
I currently have a PIX on my corporate network which is our internet firewall. the internal interface of the PIX is on a VLAN which has all the traffic being monitored by a third party software package. My question is can I setup a second internal interface on the pix in order to bypass the VLAN the internal interface1 is on.
0
Comment
Question by:dtadmin
  • 3
  • 3
  • 2
8 Comments
 
LVL 32

Expert Comment

by:rsivanandan
ID: 22758508
Why would you do this?

Cheers,
Rajesh
0
 

Author Comment

by:dtadmin
ID: 22758805
for testing purposes in order to rule out issues with the 3rd party software blocking access.
0
 
LVL 32

Expert Comment

by:rsivanandan
ID: 22759252
You can do that by putting the other interface in another VLAN and should not be a problem.

Cheers,
Rajesh
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 22759552
You cannot setup another interface on the same IP subnet, on a different vlan, if this is what you're talking about...
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 79

Expert Comment

by:lrmoore
ID: 22759556
What kind of issues are you having that you are trying to troubleshoot?
0
 

Author Comment

by:dtadmin
ID: 22759557
right now the default route on my layer3 switch is the VLAN the pix's inside interface is a member of. How do I get around that without affecting all other users?
0
 

Author Comment

by:dtadmin
ID: 22759593
I have a VLAN that has a network of 10.10.30.0/24

do I just create a route in my layer3 switch pointing all traffic from the above vlan to the seconds interface on the pix?
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 500 total points
ID: 22759670
Only if your switch supports route-maps and Policy Based Routing.
I guess I'm just not following what it is you are trying to do.
You can easily setup a new vlan with nothing more than the other pix interface and a L3 interface on the switch...
Something like this:

interface gig 0/12
 descript connection to second PIX interface
 no switchport
 ip address 10.20.30.2 255.255.255.0
ip route 0.0.0.0 0.0.0.0 10.20.30.1

PIX:
interface ethernet 2
 nameif dmz1
 ip address 10.20.30.1 255.255.255.0
nat (dmz1) 1 0 0
global (outside) 1 interface


ip address 10.20.30.1
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

I recently updated from an old PIX platform to the new ASA platform.  While upgrading, I was tremendously confused about how the VPN and AnyConnect licensing works.  It turns out that the ASA has 3 different VPN licensing schemes. "site-to-site" …
Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now