Internal network Pix configuration

Posted on 2011-05-05
Last Modified: 2012-05-11
We have a lab area that is used by customers for internet.   We have a Pix 515 firewall that we have placed between that lab and the rest of the lan.  The idea is that the Pix will help us to control the traffic originating from this lab.

I need help with creating a very simple configuration in which traffic is brought in from the lab on E0 and then passed to E1 where it enters the rest of the network traffic.   We are not ready to examine or log packets so I don't want to complicate this.   Just looking for the most basic configuration template to pass traffic through.  Both lab and lan are on the same subnet - basic class c.

Question by:egalois
    LVL 35

    Accepted Solution

    Below is a factory default config of a pix. The only thing you should need to change are the ip ranges to the ones you need.

    Building configuration...
    : Saved
    PIX Version 6.3(5)
    interface ethernet0 auto
    interface ethernet1 100full
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    hostname pixfirewall
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address outside dhcp setroute
    ip address inside
    ip audit info action alarm
    ip audit attack action alarm
    pdm logging informational 100
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0 0
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout sip-disconnect 0:02:00 sip-invite 0:03:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    http server enable
    http inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd address inside
    dhcpd lease 3600
    dhcpd ping_timeout 750
    dhcpd auto_config outside
    dhcpd enable inside
    terminal width 80
    : end

    Let me know if you need any further help with this.

    Oh, one thing (just saw that). Lab and lan need to be different subnets.

    Author Comment

    Is there no way to do this with them on the same subnet?
    LVL 35

    Assisted Solution

    by:Ernie Beek
    I'm afraid not. That's the nature of a firewall: it has to be in between networks.
    Is there any reason why that might be a problem?

    Author Comment

    If I give the devices in this lab a new subnet, will the pix515 suffice to route traffic to and from the lab?
    LVL 35

    Assisted Solution

    by:Ernie Beek
    No problem. It will Nat the traffic to the outside address of the pix, which is on the LAN. You can also let the pix act as a dhcp server for the lab network.

    Author Closing Comment

    LVL 35

    Expert Comment

    by:Ernie Beek
    You're welcome, thx for the points :)

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Should I Do With This Threat Intelligence?

    Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

    When I upgraded my ASA 8.2 to 8.3, I realized that my nonat statement was failing!   The log showed the following error:     %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows It was caused by the config upgrade, because t…
    Have you experienced traffic destined through a Cisco ASA firewall disappears and you do not know if the traffic stops in the firewall or somewhere else? The solution is the capture feature. This feature was released in 6.2(1) and works in all firew…
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    14 Experts available now in Live!

    Get 1:1 Help Now