PIX501 and MS ISA2000

[AndMartSol]

Hi
First posting so please be gentle

We are currently using ISA2000 to protect our network, don't laugh, and we want to install a PIX501 between the ADSL router and the ISA server. We currently only have 2 public ip addresses, the router and the external NIC on ISA.
From the reading I have done it seems that I would need to put the public address from the ISA server onto the PIX outside and create a private network between PIX inside and ISA.

a.a.a.1---a.a.a.2 PIX 10.0.0.1---10.0.0.2 ISA 192.168.x.x

I think what I need to do is a one-to-one nat but not sure of how the static (inside,outside) command is used. Any links or help gratefully received.

thanks
Andrew

 

[yizhar]

HI.

Yes, that way it should work.
You will need to use port forwarding because you have only a single IP address for both the pix outside interface and internal services (if you're going to publish them).

The following links will help you setting it up:

Using nat, global, static, conduit, and access-list Commands and Port Redirection on PIX

http://www.cisco.com/warp/public/707/28.html

http://teachers.sivan.co.il/yizhar/files/pixlinks.htm

The ISA is probably an SBS2000 server used for other functions like Exchange, right?

Another option you can use is disabling ISA on the SBS server, and using only a single NIC on the server.
That way the pix inside interface will connect directly to the LAN switch.
There are advantages and disadvantages for each option versus the other.

Bye


Yizhar Hurwitz

http://teachers.sivan.co.il/yizhar

 

[AndMartSol]

Hi

Thanks for the link I will investigate and try and see what I was missing.

No it isn't SBS2000 but I have already configured ISA to publish the required servers which is working well so don't really want to change it.

thanks
Andrew

 

[AndMartSol]

Hi

OK, have looked at the links and I am a bit confused.
Does static (inside,outside)interface 10.0.0.2 redirect all allowed traffic from PIX outside to 10.0.0.2?

Should I be using
static (inside,outside)tcp interface smtp 10.0.0.2 smtp netmask 255.255.255.255 0 0

to redirect SMTP and create a static for each port I want to redirect?

thanks
Andrew