Do I need a static IP address for my Cisco PIX 501?

Posted on 2011-05-10
Last Modified: 2012-05-11
I am going to replace my ATT DSL service with ATT U-Verse.  Currenty, I have a Cisco Pix 501 firewall and a Gigabit switch that connect less than a dozen computers and other ethernet devices to the Internet.  I currently have 5 static IP addresses assigned to my DSL service.  I got them so that I could run my own web server behind the firewall.  Since then, I've moved my web site to an external hosting service.  My Cisco Pix 501 is currently configured as follows:

name pix_inside
name 999.999.999.248 pix_outside
ip address outside pix_outside
ip address inside pix_inside

Open in new window

When I switch to ATT U-Verse, do I still need a static IP address to support my Cisco PIX firewall appliance?  Please explain.
Question by:carlkelley
    LVL 35

    Accepted Solution

    If there are no services running anymore (like a webserver, email, etc) that require a static address that shouldn't be a problem. Even then you could use something like dyndns.
    So you can use: ip address outside dhcp setroute in the setup, just remember that any incoming access list, outgoing nat has to have 'interface' in it instead of an public ip.
    For axample the global: global (outside) 1 interface
    LVL 5

    Expert Comment

    If you need to get to this firewall from external source i.e. for VPN or for remote management of your PIX, you could use a single static. Also, if there are no hosted services such as Web sites, webmail (OWA), exchange etc.

    I would never consider Dynamic DNS services for a business (this will be controversial), it is just another possible point of failure and I do not consider it to be designed for business use. It is more designed for advanced home users with dynamic IP addresses. In fact most Business class internet services would have at least a single public IP.

    Author Comment

    I will not be running any Internet services behind my firewall.  But, I will need to connect to various client machines via VPN for hours at a time.  

    ATT will charge an additional $15.00 per month for a block of 8 static IP addresses.  You can't get just one.  Is a static IP address necessary for any VPN connection types ?
    LVL 5

    Expert Comment

    If it is a VPN tunnel between 2 firewalls (Site to site connection) then you will need a static if not, you theoretically won't need one.

    You will need to go with dynamic dns setup for the vpn otherwise you will continually be updating the IP address on your VPN connection.
    LVL 35

    Expert Comment

    by:Ernie Beek
    Even a site to site only requires on side to have a static address. So as long as the sites that you connect to have a static address, that shouldn't have to be a problem. It might require some reconfiguration on the tunnel(s) setup though.

    Author Closing Comment

    I appreciate the Pix configuration hints.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Maximize Your Threat Intelligence Reporting

    Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

    Suggested Solutions

    Title # Comments Views Activity
    VLANs - Cisco switch and Netgear router 3 43
    CUCM and two Polycom 7936 using 3 11
    Sonicwall SSO 11 28
    VPN Client  - Windows 10 11 104
    The Cisco RV042 router is a popular small network interfacing device that is often used as an internet gateway. Network administrators need to get at the management interface to make settings, change passwords, etc. This access is generally done usi…
    There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    7 Experts available now in Live!

    Get 1:1 Help Now