Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
IP Aliasing on PIX
- Thread starter tephra
- Start date
Dave, try using the alias command.
Check this link for details:
Ian H
Check this link for details:
Ian H
Guest_imported
New member
- Jan 1, 1970
- 0
- 0
- 0
No you can't have a secondary ip address on a Pix interface.
- Thread starter
- #4
But, why do you want to have multiple addresses on the outside interface? You can of course use the static command to let a specific inside service (i e www) be accessible from internet using an other public ip address than the one specified on the interface. Also you can use other public addresses than the interface-configured on outbound traffic with by specifying the address(es) in the nat pool.
Please give us more hints of what you want to do.
Regards Jimmy
Please give us more hints of what you want to do.
Regards Jimmy
- Thread starter
- #6
Well not just the outide interface, mostly the inside interfaces. We have several public IP address ranges, and we are grouping them together, ie x.x.2.0/24 and x.x.3.0/24 need to be on 1 interface ie x.x.2.254 x.x.3.254 so that both the 2 and the 3 networks can get out.
HI.
You'll need an internal router or L3 switch for that purpose. The router will also route packets between the internal networks (unless you block it).
The pix currently can not do it, and I don't think that in the near future it will.
Bye
Yizhar Hurwitz
You'll need an internal router or L3 switch for that purpose. The router will also route packets between the internal networks (unless you block it).
The pix currently can not do it, and I don't think that in the near future it will.
Bye
Yizhar Hurwitz
We have a similar problem, a router which is external to the pix (outside) and two ranges of valid internal numbers on the same ethernet. All we want to do is let all traffic flow through the PIX, so we can dump naughty packets. It doesn't actually have to do any routing...just packet passing.
HI.
We had a similar scenario - 2 internal neighboring partner networks (different subnets) going to get to the Internet via a single pix 506 device.
Since the pix does not support this, the solution we are going to implement is to build a linux router just for the purpose of routing (it will have 3 interfaces, one to each internal subnet and one to the pix inside interface).
Of course - a layer 3 switch/router will be a better solution but more expensive, and same for replacing the pix 506 with a pix515 with 3 interfaces.
Sorry but I don't think that there is a better solution other then internal router or pix with more interfaces.
Bye
Yizhar Hurwitz
We had a similar scenario - 2 internal neighboring partner networks (different subnets) going to get to the Internet via a single pix 506 device.
Since the pix does not support this, the solution we are going to implement is to build a linux router just for the purpose of routing (it will have 3 interfaces, one to each internal subnet and one to the pix inside interface).
Of course - a layer 3 switch/router will be a better solution but more expensive, and same for replacing the pix 506 with a pix515 with 3 interfaces.
Sorry but I don't think that there is a better solution other then internal router or pix with more interfaces.
Bye
Yizhar Hurwitz
There may be one other way to do this.
Have you looked into using CIDR. This only works if your inside blocks are contiguous (i.e. 10.0.1.0, 10.0.2.0, etc. etc.), but it works better in my opionion than setting up multiple default gateways. This is becuase if a station on one of the subnets needs to talk to another, with CIDR, it won't go throught he default gateway.
As an example, using a subnet mask of 255.255.252.0 (note the third octet), you can make one "supernet" of four networks (example, 10.0.1.0, 10.0.2.0, 10.0.3.0 and 10.0.4.0) and have them all use the same Ip for a default gateway.
Just a thought...
Have you looked into using CIDR. This only works if your inside blocks are contiguous (i.e. 10.0.1.0, 10.0.2.0, etc. etc.), but it works better in my opionion than setting up multiple default gateways. This is becuase if a station on one of the subnets needs to talk to another, with CIDR, it won't go throught he default gateway.
As an example, using a subnet mask of 255.255.252.0 (note the third octet), you can make one "supernet" of four networks (example, 10.0.1.0, 10.0.2.0, 10.0.3.0 and 10.0.4.0) and have them all use the same Ip for a default gateway.
Just a thought...
- Status
Similar threads
- Locked
- Question
- Locked
- Question