2 Cisco PIX connected to same ISP connection

Posted on 2012-09-21
Medium Priority
Last Modified: 2012-10-02

I'm trying to create a VPN tunnel to my other site. The PIX 515E Firewall  currently in use has a restricted license, so I cannot add another interface to it. I also have VPN client users that connect through this FW. When I had the site-to-site working before, the VPN users were not able to connect since the other tunnel was active.

I purchased another 515E FW, assuming I could bind another ISP address to 1 interface and be on my way. This plan was also assuming I could split the ISP connection with a basic switch and have both firewalls connected at the same time. Of course, it didn't work out this way. When I have both FWs connected at the same time, both external interfaces go up and down every couple seconds.

Is there something I am missing here or is this just not possible? I added a basic diagram so you could see what I am trying to accomplish here.


             |-----Switch----ISP Cisco 1841 Router
Question by:Matt Russell
  • 5

Author Comment

by:Matt Russell
ID: 38422497
As I thought more about this, a better question would be if my main PIX can do handle both VPN types terminating at the same interface without killing the other?
LVL 37

Assisted Solution

ArneLovius earned 1500 total points
ID: 38424519
you can have site to site and remote access VPN connections on the same pix at the same time

you can have two pix connected to the same ISP at the same time, but unless they are configured as a failover cluster, they each need their own external and internal IP addresses

a suitably sanitized copy of the config would be useful

Author Comment

by:Matt Russell
ID: 38424692
I can get copies of the main PIX config since if I could keep using one with it handling both site-to-site and remote access VPNs, that woud be great.

Each unit has its own adress, externally and internally. When I connect the 2 PIXs to the same switch, the external interfaces on both start going up and down, killing the internet connection.

Let me get the config and we can go from there.
The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.


Author Comment

by:Matt Russell
ID: 38425595
Here is a cleaned copy of the config. I re-added the crypto map portions since I had to remove them previously while troubleshooting this issue.

Thanks for anything you can tell me!

Accepted Solution

Matt Russell earned 0 total points
ID: 38441057
After doing more research, I figured it out. I had to use the same crypto map for both VPN types. Thanks for trying at least.

Author Closing Comment

by:Matt Russell
ID: 38453748
My own research independent of this lead to me figuring out the correct solution.

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are times where you would like to have access to information that is only available from a different network. This network could be down the hall, or across country. If each of the network sites have access to the internet, you can create a ne…
This article is a step by step guide on how to create a basic PTP link using Ubiquiti airOS devices. This guide can be used on the following Ubiquiti AirMAX devices. Nanostation, Bullets, AirBridge, Nanobeam, NanoBridge to name a few. Please review …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

579 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question