New SDLS Router - need to change anything on PIX ??

[Iggy999]

Hi, we have just upgraded our ADSL line and have been given a new router and IP address. Do i need to change anything on the PIX to get it to talk to the outside world. Is there a config file that tells the PIX its route to the outside world, or can i just plug it into the new router and it will find its own way out.

I realise I will have to configure the VPN on inbound PIX, for sure. Hope you can help !!!

Ian

 

[DC2006]

It depends... What IP Subnet do you use between the PIX and external Firewall? Is this going to be changed because you are deploying a new router with a new IP range, etc? Give a bit more detail explaining specific IP addresses.

Darren Campbell
Technical Design Architect

 

[KiscoKid]

To get your PIX to traffic effectively you need the following at a minimum:

1. Define inside and outside IP addresses.
2. Setup NAT/PAT translations
3. Setup your IP routes.

Check this FAQ out:

http://www.tek-tips.com/faqs.cfm?fid=6029

 

[Iggy999]

Cheers for your help so far. Nothing is changing on the internal side. The PIX hangs of a bog standard ADSL router with a fixed IP address. This IP address is effectively changing so i need to know where to update the PIX config to reflect this UP address change.

Is it safe to posy my PIX config file?

Cheers

Ian

 

[KiscoKid]

You can paste your PIX config - just remove sensitive info like passwords and IP addresses.

Going back to the 3 things I highlighed that may need looking at, I want to expand on those:

1. You only need to change the outside IP address of the PIX if the DSL router it is passing traffic too has a different IP address than the previous one.
2. You only need to update your NAT/PAT rules if you are allowing traffic from outside to inside. If you are retaining the same IP public pool of addresses you may have had previously, this probably won't be an issue for you.
3. Again you may need to update your PIX routes if the address of the DSL router has changed. You will likely have a default route (0.0.0.0 0.0.0.0) pointing to a router on the outside which may need updating.

If you have the router config as well, it may prove useful. Alternatively provide as much info about your new setup as possible, i.e. the router's IP addresses, what pool of IP addresses you may have been allocated, whether external access is required into your network etc.