Solved

2nd Internet Connection on PIX 515E

Posted on 2011-03-08
14
321 Views
Last Modified: 2012-05-11
Hi All,

My company's network is behind a PIX 515E.  There are 2 subnets.  One for users and another for mission critical applications.  They currently share the same internet connection.

We will be ordering an additional Internet connection shortly.  I would like to force one of the subnets to use the new Internet connection.  If I install an additional ethernet adapter in the PIX will this be possible?  Could I do something like this:

interface2 auto
nameif ethernet2 outside2 security0
ip address outside 2 X.X.X.X
alias(inside) 10.242.55.253 X.X.X.X 255.255.255.255

interface2 = new ethernet card
x.x.x.x = IP assigned by new ISP
10.242.55.253 = IP of where 2nd subnet will be coming from that I want to force to the new ISP.

0
Comment
Question by:polaris101
  • 7
  • 5
  • 2
14 Comments
 
LVL 33

Expert Comment

by:MikeKane
ID: 35070120
Not possible.   The pix can only have 1 default gateway out to the public net.    No load balancing is possible with this unit.    

You can do internet failover with dual ISP.  http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml
However with this setup, only 1 ISP is ever active at a time.  

0
 

Author Comment

by:polaris101
ID: 35070235
Thanks MikeKane- So I can force certain internal IP's to use certain external IP's using an alias with the PIX.  But, I cannot force an internal IP to use an external IP on a different interface?

If there is now way that that is possible, do you know of an equivelant ASA model would support the configuration I mentioned?

Cisco newbie...thanks for your help.

Scott
0
 
LVL 13

Expert Comment

by:kdearing
ID: 35070425
What you're looking to do is called policy-based (conditional) routing.
This would involve buying a higher-end router/firewall.

An easier solution may be to just get a second PIX/ASA, one for each network and configure static routes on them to access the other network.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 

Author Comment

by:polaris101
ID: 35070741
kdearing- perfect.  That will most likely work.

I have a spare PIX 501 that I can use - eth0, will obviously be for the new ISP, eth1 will be for the users subnet(10.10.10.0), and eth2 will provide access to the other network for the applications (where the static route will point to- 10.242.55.0)

Can I create static routes to one of those interfaces (eth2) if the users (10.10.10.0)are trying to access 10.242.55.0 ?

Thanks!
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 35070914
Even with 1 ASA, you can have dual outbound ISPs.    You can add static routes to the 2nd ISP gateway if desired so that anything bound for 10.242.0.0 is routed outbound on the ISP2 gateway ip.      What you can't do is say If the source is x.x.x.x and dest is 10.242.0.0 then send it to ISP2.    This is policy based routing and the ASA can't do that.    

You can setup the 2 firewalls (as mentioned above).  Connect each via the DMZ or VLAN on the inside.     Use static routes on each ASA to send traffic to each other for that particular subnet.
0
 

Author Comment

by:polaris101
ID: 35071358
Ok, I think I have this straight then.

On my PIX 501, eth0 is going to be for the 2nd ISP's router (default gateway).  eth1 is going to a switch on the 10.242.55.0 network.  eth2 is going to a swith on the 10.10.10.0

I'm then going to make a static route stating that if the destination is 10.242.55.0 use eth1.

Will this work?
0
 
LVL 13

Expert Comment

by:kdearing
ID: 35071598
see attached
2-ISPs.txt
0
 

Author Comment

by:polaris101
ID: 35071796
kdearing...Ideally this is what I'd like to do since I only have 2 interfaces on the 515E. See attach.  Thoughts?  Can I make a static route on the PIX stating that if the destination is 10.242.55.0 to use eth1 ?
network.txt
0
 
LVL 13

Expert Comment

by:kdearing
ID: 35071899
Yes.
Remember to assign a 10.242.55.x address to PIX501 E1
0
 

Author Comment

by:polaris101
ID: 35072573
Great.  So, you're certain that I will be able to create a static route for traffic destined for the 10.242.55.0 network to go out the eth1 interface?  The 501's come with 5 ethernet ports. 0 is always for the default gateway I assume. Thanks for your help.
0
 

Author Comment

by:polaris101
ID: 35143631
kdearing. No luck... PIX 501 only has 2 layer 3 ports... eth0 and eth1. The other are only considered switch ports and cannot be configured.
0
 
LVL 13

Expert Comment

by:kdearing
ID: 35143861
In the diagram, swap the firewalls.
It doesn't really matter as long as one of them has three Layer-3 interfaces.

Because the 515 is fairly old, you can pick up Layer-3 interface cards for it on eBay for reasonable prices.
0
 

Author Comment

by:polaris101
ID: 35191464
Kdearing, unfortunately, swapping the PIX's isn't an option because of the site-to-site VPN's we have to the 515.

If we have to purchase another firewall, what model ASA would you recommend to support the configuration I'm looking for here?
0
 
LVL 13

Accepted Solution

by:
kdearing earned 500 total points
ID: 35191669
I think you can use the firewalls you have, plus an ehternet card for the 515
See attached diagram
2-ISPs-3-.txt
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question