Two Subnet behind PIX/ASA

pdsmicro
pdsmicro used Ask the Experts™
on
we have pix and our subnet ID is 192.168.1.0 .
the pix directly connected to internet.
there is no router behind pix.
all the PCs are getting ip from DHCP and works fine.
i now want another subnet 192.168.2.0 for few PCs instead of using the current subnet id.
is it possible to do that  whithout any router behind the PIX?
if i add this line at the pix.
i added an enry below
route inside 192.168.2.0 255.255.255.0 192.168.1.1 1
and the pc did not go to internet when i put manual ip 192.168.2.100, sunbet 255.255.255.0 DG 192.168.1.1.
thank you for your help in advance.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Ken BooneNetwork Consultant
Commented:
No you will need a layer 3 device to do the routing between the subnets on the inside.  This can be a router or a layer 3 switch.

Other than that you can put another network on another interface on the PIX but if the two networks need to talk then you have to deal with programing the PIX to allow this.
Cyclops3590Sr Software Engineer
Commented:
I'm going to say Yes*.

I put the asterisk there because it depends on a couple of things.  
1) What is the model of your PIX you have?
2) do you have a managed switch? Something capable of 802.1q trunking

If you have a PIX that can do vlan's (sub-interfaces) then you can configure the inside port as a trunk by configuring a second, logical port on the physical port.  Then you need to reconfigure the port on the switch that the PIX is connected to as a trunk.  Finally, so you're hosts can get IPs in your new subnet, you'll need to configure the PIX with dhcp relay capabilities to your 1.x server and add a 2.x pool to the dhcp server.

keep in mind that its not just the PIX model, but the PIX OS version.  For example, the 506E pix couldn't do vlans until 6.3(4) (if I am remember right, that version might've been when a different feature was finally added;  been too long)
Network Consultant
Commented:
Yes agreed but i figured that was going to be too much headache for him.  He would be much better off with a layer 3 switch and keep things simple.

Author

Commented:
thank you for your help.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial