?
Solved

Cisco Network Design

Posted on 2010-01-06
11
Medium Priority
?
646 Views
Last Modified: 2012-05-08
I have a cisco 2801 that is pretty much an all in one device.  Its serves as my connection to the ISP, does all firewalling, NATing, etc.  This 2801 then connects to a Cisco 2950 switch where all my workstation are plugged into.   I want to add a Cisco PIX 506E that will be configured for a L2L VPN Tunnel to a another location.  All this pix will do is the VPN Tunnel.  I want all firewalling, NATing, etc be remain on the Cisco 2801.  I have the inside interface of the pix connected to the 2950, but where should I connect the outside interface?  I have the outside interface configured with a public address just not sure of the best way to go about connecting it.  I attached a network diagram.  Thanks.
NetworkDiagram.jpg
0
Comment
Question by:Crossroads305
  • 5
  • 3
  • 3
11 Comments
 
LVL 33

Expert Comment

by:MikeKane
ID: 26190741
I'll offer 2 options here, depending on what you need:

OPtions 1:
A Pix VPN on a stick style setup similiar to this: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml
Where the Pix outside interface would connect to the 172.18.0.2 network on the 2950.   Follow the doc for the setup.  



Option 2:
Put the 506 in between the 2801 and the 2950 with a new subnet in between the devices.

Like the following:

Internet
|
(outside ip)
2801
(172.19.0.1) <-new IP
|
(172.19.0.2)
PIX 506E
(172.18.0.1)
|
(172.18.0.2)
2950


This would require a bit of redesign and the PIX would have to be able to handle the amount of traffic you pump through the conenctions.  Pay attention to the connection count as well.    This setup would lend the PIX to a more traditional inline firewall role.  
0
 
LVL 1

Author Comment

by:Crossroads305
ID: 26190843
Thanks.  The PIX is just temporary.  I only need the L2L tunnel for a couple weeks.  I want to do this in a way where I can just unplug the pix when we don't need the tunnel anymore.  I would like to keep the 172.18.0.1 ip address on the Cisco 2801 if possible, bucause all workstation use it as the default gateway.  If I put that address on the pix, the workstation won't have a default gateway when I take the pix away.  Is there another way to do this?  Thanks.
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 26190879
If you want to use L2L vpn the 2801 is enough, so you  not need to use PIX
0
Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 26190890
It is able to encrypt 1,5Mbps in own processor....
0
 
LVL 1

Author Comment

by:Crossroads305
ID: 26190950
They don't want to use the 2801.  I have to accomplish this with the PIX.  This is a weird situation.  I'm trying to figure out the easiest way to do this.  Thanks
0
 
LVL 1

Author Comment

by:Crossroads305
ID: 26191086
If I configure another VLAN on the switch configured with a public address, could I just connect the outside interface of the pix to the public VLAN and the inside interface to the LAN VLAN.  Would this work?  Thanks.
0
 
LVL 34

Accepted Solution

by:
Istvan Kalmar earned 1000 total points
ID: 26191134
it is working, please put another VRF the pix VLAN, for more security
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 26191203
The VLAN segments should work also.    Just be careful about ending up with multiple gateways on the same subnet.  
0
 
LVL 1

Author Comment

by:Crossroads305
ID: 26191244
Thanks.  If you look a the diagram, right now my 2801 and 2950 are connected via private address (172.18.0.x).  For this to work they would have to be connected via public address?  
0
 
LVL 33

Assisted Solution

by:MikeKane
MikeKane earned 1000 total points
ID: 26191795
Well, you could just create a new vlan interface on the router, trunk the port to the switch to carry the existing and the new vlan.   Then connect the outside interface of the PIX to an access port on that vlan.   Create a new subnet just for this traffic.    the inside interface of the pix could be on the existing VLAN.  

On the router, do a static one to one nat for the pix's newsubnet ip.     That should work in  theory...
0
 
LVL 1

Author Closing Comment

by:Crossroads305
ID: 31673486
Thanks for all your help.  They decided to just have me create the VPN on the 2801 instead of the pix.  I appreciate everything.
0

Featured Post

Shaping tomorrow’s technology leaders, today

The leading technology companies all recognize the growing need for gender diversity. Through its Women in IT scholarship program, WGU is working to reverse this trend by empowering more women to earn IT degrees and become tomorrow’s tech-industry leaders.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
As managed cloud service providers, we often get asked to intervene when cloud deployments go awry. Attracted by apparent ease-of-use, flexibility and low computing costs, companies quickly adopt leading public cloud platforms such as Amazon Web Ser…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question