dual dsl pix

[digiraven]

I've created a dsl vpn pix to pix connection with no problem. I like it so much I will probably implement it at my larger branch. The question I have since I will save so much more money from using a t1 I was curious about getting two dsl connections at one branch. Is their a way or a product from Cisco that I can use that will take advantage of two dsl's? redundancy and load balancing

thanks

 

[br0ck]

you need a router

 

[smikes19]

With a router connected to two WAN links and the PIX outside interface, will the router be responsible for NAT? If not, how is the PIX outside interface configured in this situation?

 

[mwanazed]

-------------------------------------
dsl <-|
|->router <-> pix <-> inside
dsl <-|
-------------------------------------

Let the router and the PIX sit on the same network/subnet

Then let the router do only the routing and no NAT

 

[smikes19]

Thanks, that part is somewhat obvious, but what about the configuration specifics...

Assuming 2 different wan IP blocks, what IP address is the pix outside interface given? Or, is it configured as some sort of internal/transitional network along with the router's 3rd interface?

 

[br0ck]

you could do like a 1720 with dual DSL WIC's

so:
ISP1 ISP2
|w2 |w1
[1720]
|e1
-LAN-

 

[mwanazed]

Give the PIX an address from either of the two WAN blocks but make sure you translate (NAT, PAT or static) addresses on the outside from both WAN blocks. And let the router be aware of the two WAN blocks and the appropriate routing.

For example:
WAN block 1: 10.10.1.0/29
WAN block 2: 10.10.2.0/29

PIX Configuration:
PIX oustide interface address: 10.10.1.1/29
PIX Translations: xxx.xxx.xxx.xxx <=> 10.10.10.1.3/29
zzz.zzz.zzz.zzz <=> 10.10.10.2.5/29
yyy.yyy.yyy.yyy-yyy.yyy.

http://www.ww

<=> 10.10.2.4/29

Router Cofiguration:
Ethernet address (PIX LAN): 10.10.1.2/29 primary
10.10.2.2/29 secondary
Routing:
Only define ISP-to0-you routing which may vary if you are using either one ISP or two.

I has worked for me with two WAN blocks from the same ISP.