?
Solved

PIX515e and New E10 Internet Pipe

Posted on 2010-01-07
24
Medium Priority
?
432 Views
Last Modified: 2012-05-08
We currently have two T1s (load balanced) connections coming in to our Pix firewall and we are planning to upgrade the internet pipe to fiber E10.  Our provider told us that we can keep the same IP range and stuff for the new line since it is the same carrier.  My question is: Do I have to make any changes to the PIX firewall in order to make this new connection work or it is just matter of unplug the old WAN cable from the T1 to the PIX and plug the new E10 cable.  My whole concern is do I have to make any kind of network changes or additional configuration to my Pix firewall.   Please Advice.
0
Comment
Question by:Abi_003
  • 14
  • 8
  • 2
24 Comments
 
LVL 9

Expert Comment

by:MinoDC
ID: 26201443
I'm not sure that you could connect T1 cable directly on your Firewall; Pix 515e is useful to protect your network and so it should be positioned in backward to router. In other words your LAN is connected to your firewall and outside interface of firewall is connected to router LAN ( doesn't matter wich connection your provider decide to use T1 or E10).

So if we were to assume that this network topology exists, you have no need to change anything.
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 26201469
Be aware , the PIX only does 10/100 on the interfaces.   If all IP remains unchanged after the swap, then just unplug one cable and plug in the other.  
0
 

Author Comment

by:Abi_003
ID: 26201728
E10 is a 10 Mbps so we should be good then... PIX will automatically picks up the new bandwidth?
0
Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  

 

Author Comment

by:Abi_003
ID: 26201749
MinoDC: T1 cables goes to a regular linksys hub then from the hub its going to the PIX firewall..
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 26202033
The T1 cable is not ethernet, you need CSD.DSU on a router with annother ethernet port to properly route a T1 line...  There must be a router or an ISP modem or something that routes out to the telco...  ARe you using Metro E by any chance?  



0
 

Author Comment

by:Abi_003
ID: 26202403
T1 line is coming in to a Cisco router which was provied by the ISP from the router there is a CAT5 cable going into the liksys hub then from the hub its goes to the pix firewall network interface
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 26202741
Then as long as the ips delivered through the router change... then just make sure you haven't hard coded speed on the interface that shouldn't be there (i.e. duplex rate).   Other than that, you shouldn't have to change anything.
0
 

Author Comment

by:Abi_003
ID: 26202892
do you know where i can check that on Cisco ASDM ?
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 26203870
Sorry about the bad english on my last post...     As long as the Ips in the router DONT change, then you are ok.  

Check any interface settings in the ASDM in CONFIGURATION->INTERFACES and EDIT the outside interface.   Click on the COnfig hardware properties button to see the settings.
0
 

Author Comment

by:Abi_003
ID: 26204059
ok.. this is what i see on the 'outside' interface properties

Hardwre Port: ethernet0

Media Type: RJ45
Duplex: Auto
Speed: Auto
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 26204175
Then it should work fine.    You can probably tweak performance a bit by hard coding the FULL Duplex entry in the interface.   But thats optional.
0
 
LVL 9

Expert Comment

by:MinoDC
ID: 26207978
Based on what you wrote in your question, and what you wrote in the answers, you need not make any changes or configure on your pix.
0
 

Author Comment

by:Abi_003
ID: 26209844
thanks for your responses guys.. i'll try this next week..  hopefully things will be smooth as i think.. (matter of unplug the old T1 cable and plug the new e10 cable ) and call it a day.. lets see..
0
 

Author Comment

by:Abi_003
ID: 26317370
another quick question: do i have to shutdown the pix in order to do this change or i can do this on the fly... for an example while the pix is on unplus the old t1 cable and plus the new e10 cable... please advice..
0
 

Author Comment

by:Abi_003
ID: 26362691
any info on this?
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 26372024
Sorry, about the delay.  

You can safely plug and unplug any network connection on the appliance....   So long as there is no change in IPs as stated, the port should come up in 30 seconds or so....   Worse case is that you may have to clear out the arp "CLEAR ARP" so that it finds the new router's mac....  

0
 

Author Comment

by:Abi_003
ID: 26374494
ok.. thanks .. we will have the same IPs but in addition we will receive more static IPs from our ISP for our web servers...  if this is the case.. what should i do...
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 26381788
Is your IP's subnet mask changing?   If so then you have to adjust the mask on the outside interface.    If you are getting just a random block of addresses, different from your current ips, then there is nothing to do.   You can just start assigning them to Statics and/or pools...
0
 

Author Comment

by:Abi_003
ID: 26439353
i just reveived an email from our ISP saying that we are receiving a secondary IP block which is seperate from our exsiting one.. (exsisting one is 216.x..x.x/26 and the secondary one is 74.x.x.x/27) now they want me to add this secondary blcok into my pix firewall... how do i do this?
0
 

Author Comment

by:Abi_003
ID: 26442608
I am not certain as if my Firewall (PIX-515E)supports secondary IP blocks... can you please tell if my firewall can support this... or what is the best option to go with...
 
With regards to the Cisco 1811 router that my ISP will provide for this service, the secondary block can be configured as:

SECONADY
interface FastEthernet0
     ip address 216.x.x.x 255.255.255.192
     ip address 74.x.x.x 255.255.255.224 secondary
OR
DEFAULT ROUTE
ip route 74.x.x.x255.255.255.224 (FIREWALL IP?????)
0
 

Author Comment

by:Abi_003
ID: 26442610
which one should i choice to match my case??? please help
0
 

Author Comment

by:Abi_003
ID: 26454126
any update on this please?
0
 

Author Comment

by:Abi_003
ID: 26495706
MikeKane: any update on this, please?
0
 
LVL 33

Accepted Solution

by:
MikeKane earned 2000 total points
ID: 26524774
Sorry for the late reply...  

The secondary block should just route correctly.     For example, I have a setup with a Metro-E where the Lead router uses 1 IP and routes a completely separate block...  

Will the IP's route correctly to the firewall?   Will the new block use the same gateway for routing?  

The ASA will not support multiple IP's on the same interface, but you can have multiple VLANs, however, you can still only have 1 outbound, catch-all route....

0

Featured Post

The IT Degree for Career Advancement

Earn your B.S. in Network Operations and Security and become a network and IT security expert. This WGU degree program curriculum was designed with tech-savvy, self-motivated students in mind – allowing you to use your technical expertise, to address real-world business problems.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Originally, this post was published on Monitis Blog, you can check it here . It goes without saying that technology has transformed society and the very nature of how we live, work, and communicate in ways that would’ve been incomprehensible 5 ye…
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question