PIX501 and DSL Modem

[hcclSmokey]

Hi There

I currently have my PIX501 connected to a DSL Router/Firewall. Am I limiting the funtionality of the PIX by connecting to another firewall ? At the moment I seem to have to make changes in two places for things to work. Would it be better to get a DSL modem and let the PIX do the firewall job ? If so can anyone suggest a DSL modem to purchase...

Thanks
Smokey

 

[EddieVenus]

hcclSmokey,

Yes, it would be better to have just a DSL modem. You are in fact making 2x as much work for yourself. Possible limiting what you can do. But you may not need to purchase anything. In most cases you can set the DSL modem to act like just a modem. Essentially this means turning off NAT, since most "firewalls" are just NAT firewalls, and unlike the PIX or other dedicated firewall devices, do not do other sorts of filtering.

I suggest that you find the manual for your DSLmodem/firewall online and find out how to turn off NATing. You will then have a DSL modem with a routeable address assigned to it. Essentially it will just be a router now. You just give it an "inside(LAN) address" of something like 172.16.254.253 255.255.255.252 and set DHCP to on for the inside(LAN) interface. Then set the PIX up for DHCP on its "outside (WAN) interface". Now your PIX is the only firewall and you can do what you want without the extra steps or restrictions of the other firewall. Alternatly you could set the PIX manually, with an outside address of 172.16.254.254 255.255.255.252 thus completeing your mini subnet of 2 devices and assuring that you will not get routing issues due to that subnet.

One important factor to making this easy is make sure that the subnet used between the DSLmodem/router and the PIX is different from the subnet used for your LAN, or LANs. Since this will cause routing issues. I.E. do not use 192.168.1.X for you LAN and for the subnet between the PIX and the DSL modem. Make sure that the inside and outside addresses of the PIX are not both set to the same numbers for the first 3 octets of their IP address. (1.2.3.4)

Eddie Venus

"These pipes are CLEAN!!" - Chris Elliot (Cabin Boy)