Internal Firewall

[jdl508]

I am about to buy 2 pix 515's
setting up a 3 teired dmz
internet
app
corp
my question is instead of using 1 pix with multiple interfaces for dmz's we are using 2 pix each with 3 interfaces
heres the Question

is it better practice to have the 2nd pix(internal) plugged into the switch hanging off the firewall or directly into the 3rd firewall interface ie:

Internet router -> PIX1 -> dmz1switch -> pix2

OR

Internet router -> pix1 >int1 = dmz1switch /int2 = pix2 -> dmz2switch
Iknow I have posted something like this before but there is NO way my company will go with the easier single FW config so here goes nothing


thanks

 

[yizhar]

HI.

If you must put 2 pix devices in a row, then I suggest that only one of them will do NAT -
I think that pix1 connected to the internet should have nat disabled and using registered addresses for DMZ and internal pix2, and pix2 should NAT for internal users.

About the 2 options you mentioned, I don't know.

I think that pix2 can have 2 interfaces only, but pix1 should have 3 interfaces or better 4 and if you can go for a failover configuration and PIX515UR.

Bye

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[ChrisAC]

What's your reason for doing this rather than using multiple interfaces on one PIX?

Chris.
************************
Chris Andrew, CCNA
chrisac@gmx.co.uk
************************

 

[jdl508]

The reasoning behind this is we have a core software sys and this is the infrastructure 'they' recommend
i tried to explain to mgmt. that it would be easier and better to go with 1 525 with the 4 port interface
but they want to make sure the software company doesnt gripe about it so Im stuck and guess who gets to support / config this monster
For Yizhar:
Why would you go with nat only on pix2 i would think nat on pix1 because that has the only public ip (web server outside pix int etc.)?
thanks

 

[yizhar]

HI.

The NAT design is specific to your needs,
all options are possible (NAT on each, NAT on one of them, no NAT at all).

Some multimedia, VPN and other applications might fail to work with NAT/PAT, and troubleshooting this in double nat is more dificult.

Another possible configuration is PAT on pix1 and NAT on pix2.

Bye

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[whegge]

My suggestion, to get back to your original question, is I would use a switch (or a hub) between the PIX's. The reason for this troubleshooting. You will probably have problems with something communicating through the 2 pix's. At least initially, so a swithc or hub between the 2 will allow you to put a PC between the Pix's and troubleshoot down to one of the Pix's.

Wes Hegge