PIX initial setup

[basmithmia]

Hi all,

I’m new to Cisco products so if I sound a little green, sorry. I have recently purchased a PIX 501 and would like some pointers in setting it up in the following configuration.

DSL Router w/ 1 Static IP
|
|
Pix Firewall
| | |

| | |

DMZ Workstations Servers

(Router currently doing NAT and some port forwarding i.e. Terminal services, PC anywhere and

http://WWW.)

The DMZ would include a

http://WWW server

and a Terminal / VPN / Database Server. This is a B2B

http://WWW server

and we do Windows Authentication for users to log into the server. The

http://WWW server

will have an app that uses Cold Fusion to connect to the data base server. The VPN and Terminal server has not been configured yet so I’m open to suggestions.

I have 13 client workstations that need to connect to the DMZ and the internet. Again I’m new to these products so if I haven’t given enough info let me know what else you need.

Thanks,
Bruce

 

[tbissett]

These three links should get your started:

1) Configuring PPPoE on the PIX (if your ISP is using PPPoE

http://www.cisco.com/warp/public/110/pppoe-for-pix501.html

2) Configuring the PIX for a single internal network

http://www.cisco.com/warp/public/110/19a.html

3) Cisco's Samples & Tips area

http://www.cisco.com/pcgi-bin/Suppo...tware_Configuration#Software_Samples_and_Tips

 

[12122053]

What are you using for the DMZ? The 501 does not have a dmz interface. You could do static nat mappings.

 

[yizhar]

HI.

As mentioned above, the pix 501 does not support DMZ.

> Router currently doing NAT ....
It is best to replace the router and let the pix be the only device which does NAT. Placing the pix behind another NAT device will cause problems.
Contact your ISP about this issue.
Two options are:
* Replace the router with a DSL modem, and let the pix do PPPoE dialing.
* OR: Reconfigure the router to use public ip addresses only with simple routing and no nat.

> This is a B2B

http://WWW server

So if your only going to accept inbound http traffic from a known ip address, you should setup the access-list that way (to allow incoming traffic on port 80 only from the other party known ip address/subnet).

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar