ISP routing two discontiguous subnets; can PIX 501 handle that?

[JMCraig]

Hi Folks,

OK. Here's the mess I've got myself into. PIX 501's outside port is set for DHCP; the ISP routes 204.x.x.128/29 IP subnet to me. Inside interface is set to 204.x.x.129/255.255.255.248--that all works great. Been working for a long time.

Now, I want to add another 8-IP subnet of public IPs. My ISP assigned me 166.y.y.176/29. ISP can route that subnet's traffic through the same IP as the initial one, but I need to figure out how to specify multiple inside IP's or use static routes or something to deal with this in the PIX itself.

Can I just define a static route so 166.y.y.176/255.255.255.248 uses the 204.x.x.129 gateway? (I don't have much confidence a static route like that is going to work--just making guesses.)

Have I exceeded what the PIX 501 can do? (I do not seem to be able to just add another "inside" interface setup.) Or am I just hampered by using the web interface and I could add a second "inside" gateway IP via the command line interface?

(As you can see, I've exceeded my personal capabilities!)

Thanks for any suggestions/help.



John Craig
Alpha-G Consulting, LLC

http://www.alphagconsulting.com

 

[NetworkGhost]

You will never exceed what the PIX can do!

How will the new subnet be used? Is there a router on the internal side of the PIX?

The PIX cannot have secondary IP addresses so if you dont have a router internally you do have the option of increasing your internal network range and doing static translations for hosts that require an IP from the new ISP range.

http://www.wr-mem.com

 

[JMCraig]

You will never exceed what the PIX can do!

Well, actually, it'd sure be handy if someone could connect via VPN and then go back out to the Internet as if they were coming behind the firewall--but apparently the ASA5505 can do that.... Haven't spent the money on that yet, but maybe it's time? Can I just set up multiple internal addresses on that unit?

How will the new subnet be used?

The new IPs need to be public. What I'd hoped to do was to allow outside users to connect up to temporary web test setups (but I have to be able to restrict the access to the test machines--e.g. via the Access Lists in the PIX). The access needed is HTTP and HTTPS (possibly SSH in a few cases).

Is there a router on the internal side of the PIX?

I do have a router hooked up although it's pretty simplistic (it's built into the Linksys Wireless unit I've got). I also have another PIX that I could hook up, if that would help. I could also configure one of the servers itself to function as a router, I suppose (they all have multiple NICs).

Unfortunately, I'm not clear on how I'd use the router. Or if I just put a static route on the server itself so that anything other than in the same subnet gets routed through 204.x.x.129 (the PIX inside IP), can I then have a corresponding static route on the PIX and have everything talk?

The PIX cannot have secondary IP addresses so if you don't have a router internally you do have the option of increasing your internal network range and doing static translations for hosts that require an IP from the new ISP range.

Are you saying I would set the IP on the server in question up as a non-routable address (192.168.x.x or 10.x.x.x) and use static routes in the PIX to point a particular public address to that internal IP?

Thanks!

John Craig
Alpha-G Consulting, LLC

http://www.alphagconsulting.com

 

[NetworkGhost]

Well, actually, it'd sure be handy if someone could connect via VPN and then go back out to the Internet as if they were coming behind the firewall--but apparently the ASA5505 can do that.... Haven't spent the money on that yet, but maybe it's time? Can I just set up multiple internal addresses on that unit?

Yeah, I was joking a bit with my comment.

I do have a router hooked up although it's pretty simplistic (it's built into the Linksys Wireless unit I've got). I also have another PIX that I could hook up, if that would help. I could also configure one of the servers itself to function as a router, I suppose (they all have multiple NICs).

Unfortunately, I'm not clear on how I'd use the router. Or if I just put a static route on the server itself so that anything other than in the same subnet gets routed through 204.x.x.129 (the PIX inside IP), can I then have a corresponding static route on the PIX and have everything talk?

I think you got the idea. Basically if you could not place these servers off the PIX inside interface and do one to one nat then you could put the devices behind the router and just route the forward the range from the PIX to the router.

Are you saying I would set the IP on the server in question up as a non-routable address (192.168.x.x or 10.x.x.x) and use static routes in the PIX to point a particular public address to that internal IP?

Yes I am saying that. I would actually recommend this unless you have some limitation that these devices have to be assigned a routable IP address. You could then do statics on the PIX to translate for you.

http://www.wr-mem.com