[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

virtual I.P on PiX DMZ interface

Posted on 2009-04-01
7
Medium Priority
?
381 Views
Last Modified: 2012-05-07
I have 2 PIX firewalls ...
I want to know that just like we have virtual I.P's in HSRP and clients point to that virtual I.P, can we have something similar or like that in PIX firewall as well ? Reason am asking is because the scenario is where ive two PIX firewalls and behind each fix pirewalls is a router (smthg like this given below)
Router 1--> Pix 1--> Internet
Router 2--> Pix 2--> Internet

I want to run HSRP on both routers and only issue I see is that in case of an hsrp failover (i.e. router 1 fails and router 2 becomes the active one), servers in dmz will keep forwarding traffic to Pix 1 DMZ Interface I.P (coz its not gonna know when the HSRP has failed over) whereas it should be sending traffic to Pix 2 DMZ I.P since thats the active one now !

Was i able to explain the issue ?
0
Comment
Question by:nabeel92
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 23

Expert Comment

by:debuggerau
ID: 24045617
PIX has HSRP as well, it is a licensed addition however, and only available on the larger PIX's..
0
 

Author Comment

by:nabeel92
ID: 24045793
how can i check that on my pix ?

firewall1/failovergroup2# sh version

Cisco PIX Security Appliance Software Version 8.0(2) <context>
Device Manager Version 6.0(2)

Compiled on Fri 15-Jun-07 18:25 by builders

firewall1 up 28 days 1 hour
failover cluster up 28 days 10 hours

Hardware:   PIX-515E

Licensed features for this user context:
Failover                     : Active/Active
VPN-DES                      : Enabled
VPN-3DES-AES                 : Enabled
GTP/GPRS                     : Disabled

Configuration last modified by enable_15 at 04:28:50.536 UTC Fri Mar 27 2009
0
 

Author Comment

by:nabeel92
ID: 24045831
I hope you're not referring to HSRP as Pix Active/Active failover configuration ? because that's what I already have ... I am talking about the HSRP with conventional standby commands, etc
0
Are You Ready for GDPR?

With the GDPR deadline set for May 25, 2018, many organizations are ill-prepared due to uncertainty about the criteria for compliance. According to a recent WatchGuard survey, a staggering 37% of respondents don't even know if their organization needs to comply with GDPR. Do you?

 
LVL 23

Expert Comment

by:debuggerau
ID: 24046294
I dont think so, check these other comments:

http://www.experts-exchange.com/Security/Software_Firewalls/Q_21474131.html
http://www.experts-exchange.com/Hardware/Networking_Hardware/Routers/Q_22057262.html

wouldn't a least cost route give you the flexibility you need there?
PIX to use router 1 as least cost (10) and router 2 for the next highest (20)..
0
 

Author Comment

by:nabeel92
ID: 24046393
wouldn't a least cost route give you the flexibility you need there? >> Can u elaborate further as am unable to understand what you meant !  my setup is pretty much similar to the one mentioned in the second post ...
0
 

Author Comment

by:nabeel92
ID: 24046405
or if i were to rephrase my question, it would be "does pix have any other way of redundancy except for active/active or active/standby" ?
0
 
LVL 23

Accepted Solution

by:
debuggerau earned 2000 total points
ID: 24055513
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Did you know SD-WANs can improve network connectivity? Check out this webinar to learn how an SD-WAN simplified, one-click tool can help you migrate and manage data in the cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A 2007 NCSA Cyber Security survey revealed that a mere 4% of the population has a full understanding of firewalls. As business owner, you should be part of that 4% that has a full understanding.
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question