2 External Interfaces on PIX with Wireless router on one External
Posted on 2009-04-02
I have a PIX firewall with two external interfaces. One interface has our AT&T DIA and one has AT&T DSL. We have the PIX set up to use the DIA for the default route with metric 1 and the DSL for the default route on metric 2 (back up Internet connection basically). Currently, we have a wireless router on the DSL line mainly for our vendors/auditors when the come in so they can have access the the Internet.
I would like to make it so that you can VPN into the PIX on the DIA if we have a laptop on the wireless in part of the building without a network jack. With the security rules in place, I cannot connect to the DIA public IP from the DSL because of reverse path check.
However, I could add a default route on the outside interface for the ip address of my wireless router to the gateway ip address for the DSL modem.
i.e. modem=172.16.1.1 , router=172.16.1.3 ------ route outside 172.16.1.3 255.255.255.255 172.16.1.1
(example IP addresses. I have a public IP address for this router and modem)
This allows me to then connect to the VPN on the DIA public IP from the wireless on the DSL.
Now my question though, am I leaving myself open to a security issue?
The only incoming rules from the DSL interface are currently
~ implicit to permit scr 'any' dst 'less secure networks' to service ip, and
~ implicit deny rule any any
Thanks in advance for your comments/suggestions.