?
Solved

2nd Internet Connection on PIX 515E

Posted on 2011-03-08
14
Medium Priority
?
325 Views
Last Modified: 2012-05-11
Hi All,

My company's network is behind a PIX 515E.  There are 2 subnets.  One for users and another for mission critical applications.  They currently share the same internet connection.

We will be ordering an additional Internet connection shortly.  I would like to force one of the subnets to use the new Internet connection.  If I install an additional ethernet adapter in the PIX will this be possible?  Could I do something like this:

interface2 auto
nameif ethernet2 outside2 security0
ip address outside 2 X.X.X.X
alias(inside) 10.242.55.253 X.X.X.X 255.255.255.255

interface2 = new ethernet card
x.x.x.x = IP assigned by new ISP
10.242.55.253 = IP of where 2nd subnet will be coming from that I want to force to the new ISP.

0
Comment
Question by:polaris101
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 5
  • 2
14 Comments
 
LVL 33

Expert Comment

by:MikeKane
ID: 35070120
Not possible.   The pix can only have 1 default gateway out to the public net.    No load balancing is possible with this unit.    

You can do internet failover with dual ISP.  http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml
However with this setup, only 1 ISP is ever active at a time.  

0
 

Author Comment

by:polaris101
ID: 35070235
Thanks MikeKane- So I can force certain internal IP's to use certain external IP's using an alias with the PIX.  But, I cannot force an internal IP to use an external IP on a different interface?

If there is now way that that is possible, do you know of an equivelant ASA model would support the configuration I mentioned?

Cisco newbie...thanks for your help.

Scott
0
 
LVL 13

Expert Comment

by:kdearing
ID: 35070425
What you're looking to do is called policy-based (conditional) routing.
This would involve buying a higher-end router/firewall.

An easier solution may be to just get a second PIX/ASA, one for each network and configure static routes on them to access the other network.
0
Optimum High-Definition Video Viewing and Control

The ATEN VM0404HA 4x4 4K HDMI Matrix Switch supports 4K resolutions of UHD (3840 x 2160) and DCI (4096 x 2160) with refresh rates of 30 Hz (4:4:4) and 60 Hz (4:2:0). It is ideal for applications where the routing of 4K digital signals is required.

 

Author Comment

by:polaris101
ID: 35070741
kdearing- perfect.  That will most likely work.

I have a spare PIX 501 that I can use - eth0, will obviously be for the new ISP, eth1 will be for the users subnet(10.10.10.0), and eth2 will provide access to the other network for the applications (where the static route will point to- 10.242.55.0)

Can I create static routes to one of those interfaces (eth2) if the users (10.10.10.0)are trying to access 10.242.55.0 ?

Thanks!
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 35070914
Even with 1 ASA, you can have dual outbound ISPs.    You can add static routes to the 2nd ISP gateway if desired so that anything bound for 10.242.0.0 is routed outbound on the ISP2 gateway ip.      What you can't do is say If the source is x.x.x.x and dest is 10.242.0.0 then send it to ISP2.    This is policy based routing and the ASA can't do that.    

You can setup the 2 firewalls (as mentioned above).  Connect each via the DMZ or VLAN on the inside.     Use static routes on each ASA to send traffic to each other for that particular subnet.
0
 

Author Comment

by:polaris101
ID: 35071358
Ok, I think I have this straight then.

On my PIX 501, eth0 is going to be for the 2nd ISP's router (default gateway).  eth1 is going to a switch on the 10.242.55.0 network.  eth2 is going to a swith on the 10.10.10.0

I'm then going to make a static route stating that if the destination is 10.242.55.0 use eth1.

Will this work?
0
 
LVL 13

Expert Comment

by:kdearing
ID: 35071598
see attached
2-ISPs.txt
0
 

Author Comment

by:polaris101
ID: 35071796
kdearing...Ideally this is what I'd like to do since I only have 2 interfaces on the 515E. See attach.  Thoughts?  Can I make a static route on the PIX stating that if the destination is 10.242.55.0 to use eth1 ?
network.txt
0
 
LVL 13

Expert Comment

by:kdearing
ID: 35071899
Yes.
Remember to assign a 10.242.55.x address to PIX501 E1
0
 

Author Comment

by:polaris101
ID: 35072573
Great.  So, you're certain that I will be able to create a static route for traffic destined for the 10.242.55.0 network to go out the eth1 interface?  The 501's come with 5 ethernet ports. 0 is always for the default gateway I assume. Thanks for your help.
0
 

Author Comment

by:polaris101
ID: 35143631
kdearing. No luck... PIX 501 only has 2 layer 3 ports... eth0 and eth1. The other are only considered switch ports and cannot be configured.
0
 
LVL 13

Expert Comment

by:kdearing
ID: 35143861
In the diagram, swap the firewalls.
It doesn't really matter as long as one of them has three Layer-3 interfaces.

Because the 515 is fairly old, you can pick up Layer-3 interface cards for it on eBay for reasonable prices.
0
 

Author Comment

by:polaris101
ID: 35191464
Kdearing, unfortunately, swapping the PIX's isn't an option because of the site-to-site VPN's we have to the 515.

If we have to purchase another firewall, what model ASA would you recommend to support the configuration I'm looking for here?
0
 
LVL 13

Accepted Solution

by:
kdearing earned 2000 total points
ID: 35191669
I think you can use the firewalls you have, plus an ehternet card for the 515
See attached diagram
2-ISPs-3-.txt
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
In this article, we’ll look at how to deploy ProxySQL.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question