Understanding IP routing if PIX 515

[robharper]

I think after reviewing many of the posts here my PIX may be setup fine but my lack of understanding how it routes may be the issue.

I have two IP ranges on the inside of the PIX:

192.168.10.0
142.142.xxx.xxx

The 142.142.xxx.xxx range is actually part of an external range setup to access a large pool of Lotus Notes servers (200 plus servers) of which I have little knowledge of the setup beyond my own scope.

While I can access this range by VPN it is unavilable from inside the PIX

I have the following route statement in place:

route inside 142.142.xxx.xxx 255.255.255.0 192.168.10.1 1

I also have a static setup as follows:

static (inside,outside) 142.142.xx.0 142.142.xx.0 netmask 255.255.255.0 0 0

Generally speaking the problem is of course that I cannot access my Notes server while using the PIX for Internet access. We have another internet connection already but it is a very slow T1 with heavy access. The change in the DG is my issue. I use the PIX as the DG for an ADSL connection which is great but lose access to the Notes Server.

Any suggestions would be great, not sure where to go from here.

 

[gbiello]

The way you state the problem, it's a little unclear of what network is where, but I think I know what you're getting at.

Here is the problem: If you want to redirect (route) a packet out the SAME interface it arrived, you can't do it. I.E., if a packet hits the PIC on the internal interface, the PIX will not send it back out the internal interface.

It that is not your problem, please specify a bit more and post a config.

-gbiello

 

[baddos]

Yes... Is the 142.142.xxx.xxx on your inside or outside interface? If it's on the outside, then change your route statement to this:

route outside 142.142.xxx.xxx 255.255.255.0 192.168.10.1 1

 

[robharper]

gbiello,

Hey I have been reading about your comment and this may in fact be the issue here.

The 142 range (which is an external address) is on the inside.

So if it will not redirect on the same interface, any idea on how I can I get around this issue?

 

[gbiello]

1) You can make 192.168.10.1 your default gateway and let that route back to the PIX.

2) You can put static routes to the 142.142.xxx.xxx network on all devices on 192.168.10.x.

3) You could get a Cisco 2621 (or better) and put that between the PIX and the internal network. This is the option I go for on most of our clients with private WANs.

hope this helps,
-gbiello