IP Aliasing on PIX

[tephra]

Hi Guys,

Does anyone know if you can IP alias on the PIX?
Ie bind 2 or more IP's to the one interface?

Cheers
Dave

 

[ihunter]

Dave, try using the alias command.

Check this link for details:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_61/cmd_ref/qref.htm#xtocid0

Ian H

 

[Guest_imported]

No you can't have a secondary ip address on a Pix interface.

 

[tephra]

Yeah thats what i thought, which is really crap!

Might put in a feature request (Good if the PIX did
VLAN trunking as well

Cheers
Dave

 

[Jimmbo]

But, why do you want to have multiple addresses on the outside interface? You can of course use the static command to let a specific inside service (i e www) be accessible from internet using an other public ip address than the one specified on the interface. Also you can use other public addresses than the interface-configured on outbound traffic with by specifying the address(es) in the nat pool.

Please give us more hints of what you want to do.

Regards Jimmy

 

[tephra]

Well not just the outide interface, mostly the inside interfaces. We have several public IP address ranges, and we are grouping them together, ie x.x.2.0/24 and x.x.3.0/24 need to be on 1 interface ie x.x.2.254 x.x.3.254 so that both the 2 and the 3 networks can get out.

 

[yizhar]

HI.

You'll need an internal router or L3 switch for that purpose. The router will also route packets between the internal networks (unless you block it).

The pix currently can not do it, and I don't think that in the near future it will.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[coins]

We have a similar problem, a router which is external to the pix (outside) and two ranges of valid internal numbers on the same ethernet. All we want to do is let all traffic flow through the PIX, so we can dump naughty packets. It doesn't actually have to do any routing...just packet passing.

 

[yizhar]

HI.

We had a similar scenario - 2 internal neighboring partner networks (different subnets) going to get to the Internet via a single pix 506 device.

Since the pix does not support this, the solution we are going to implement is to build a linux router just for the purpose of routing (it will have 3 interfaces, one to each internal subnet and one to the pix inside interface).

Of course - a layer 3 switch/router will be a better solution but more expensive, and same for replacing the pix 506 with a pix515 with 3 interfaces.

Sorry but I don't think that there is a better solution other then internal router or pix with more interfaces.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[stevenk1981]

the pix is a firewall not a router

 

[tbissett]

There may be one other way to do this.


Have you looked into using CIDR. This only works if your inside blocks are contiguous (i.e. 10.0.1.0, 10.0.2.0, etc. etc.), but it works better in my opionion than setting up multiple default gateways. This is becuase if a station on one of the subnets needs to talk to another, with CIDR, it won't go throught he default gateway.

As an example, using a subnet mask of 255.255.252.0 (note the third octet), you can make one "supernet" of four networks (example, 10.0.1.0, 10.0.2.0, 10.0.3.0 and 10.0.4.0) and have them all use the same Ip for a default gateway.

Just a thought...