PIX firewall

Posted on 2008-11-15
Medium Priority
Last Modified: 2012-06-27
We have a cisco router that has a public IP address on the outside interface.  the inside interface needs to pass traffic to a Cisco PIX firewall maintained by the customer.

The customer wants to us our network as a second route to the Internet by assigning IP address that connects to our Cisco router.

Their PIX has a primary Internet connection via another provider.
We can get to the Internet via our router, however, the PIX is not passing traffic to and from the customer PIX.

Does anyone have the necessary configs?  Is this a NAT issue?  If this is a NAT issue, can anyone provide me with the proper configs?
Question by:wwtruebtv

Assisted Solution

TNL_Engr earned 1000 total points
ID: 22967976

I believe the problem may be that the Pix does not allow packets to route back out the same interface they are received on (security feature).  If the client's default gateway is the Pix, then the Pix will not be able to send the packets back into the network to find another gateway.  You would need to use another routing device on the inside of the network to route in either direction.

Author Comment

ID: 22967990
TNL Engr

Thank you for your reply.  The client has a Cisco engineer who said that he should be able to this.

I believed what you said as the issue, but was shot down by the customer.

It worked once before but we gave them a public IP for their PIX which we are not willing to do.

Am I hearing you make the suggestion that they add a Cisco router as the PIX gateway for their Interface and point it to our router?

thank you for your respone
LVL 14

Expert Comment

ID: 22968171
post your Pix config.

Expert Comment

ID: 22968307
If I understand your network properly, one way of doing it would be to place a router inside the network which would route to either the customer's Pix or to your router.  Use the new router as the default gateway for their clients, and assign the two routes to the Internet.  Of course, you could simply use your Cisco router as the default gateway, but then their traffic would try to exit via your Internet connection first, instead of as a backup.

I don't know if there is any way to bypass this particular feature of the Pix firewall.  Hopefully, someone else will respond if it is possible.  I recently changed over the majority of my clients with Pix's to Cisco ASAs.  I know you can set the ASA to allow traffic back out of the same interface since a couple of customers have requested it.

Hope this helps.
LVL 33

Accepted Solution

MikeKane earned 1000 total points
ID: 22979940
I'm backing up the statement from TNL_Engr.    The PIX will not route back into the same interface.   The Cisco ASA's can do this with subinterfaces, but not the pix.   You will need another device to do the routing.    

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

On Feb. 28, Amazon’s Simple Storage Service (S3) went down after an employee issued the wrong command during a debugging exercise. Among those affected were big names like Netflix, Spotify and Expedia.
Will you be ready when the clock on GDPR compliance runs out? Is GDPR even something you need to worry about? Find out more about the upcoming regulation changes and download our comprehensive GDPR checklist today !
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question