Using PIX 501 as Default Gateway 1

[just2n]

I've got a Cisco 501 that I'm trying to configure to replace our existing Netgear FVS318 "Firewall"/Router.

First off, I can't seem to get a straight answer in regards to this but, is it possible to use the 501 as the default gateway for the network? The setup quide says you just plug the firewall (outside) into your dsl/modem and then the (inside) to a switch and the default settings should suffice.

The topology I'm aiming for would be the following:

T1 -> PIX501 -> [2950] + [2950] -> 192.168.0.X

The two 2950's I'd like to cluster together, and then just plug my internal network hosts into the cluster. Am I missing something?

I've tried plugging the 501 into our existing T1 modem (which cirrently goes into our FVS318) but I cannot seem to get to the net. I'm using the default settings except for changing the outside IP to our current static IP and then the internal IP to an internal IP.

I'm stumped. Can anyone offer some suggestions?

Thanks,

- Justin

 

[chucksel]

Hi.

What is it about the FVS318 that you do not like? We use a mix of these and the 501's at remote sites to connect to our Cisco 3000 VPN so I am just curious.

You realize that the 501 is limited to 10 users, right? It seems with a T1 (not DSL) and a couple cisco switches that you might outgrow the 501 quickly?

Are you using the outside interface with a static IP or are you using DHCP over PPOE?

If you have a small "flat" network (only 1 subnet or network) with no router in between the clients and the PIX 501, then yes the PIX 501's INSIDE interface's IP address will be the clients (and servers) default gateway.

Chuck

 

[just2n]

Hey Chuck,

I am primarily interested in the 501 as it seems out FVS318 is withering. Every once in a while our conenction to the net drops off and is back a second later. I have no issues with any machines with external interfaces.

I'm aware of the limitations of 10 users for the 501. I wanted to purchase a 50 user, but my hands are tied as my boss would not make the buy (no matter how much I pushed for it). We won't go over 10 users for a while so we will get by for now.

We have do have a flat 192.168.0.X network. My next question is in regards to getting the 501 setup as the default GW. I have a small (external) switch that our T1 goes into. Our FVS318 (192.168.0.1) and 501 (192.168.0.243) are both plugged into it, then users plug into the FVS318. Currently users have 192.168.0.1 as the default GW. To test the 501 I change my default GW to 192.168.0.243 but cannot get out. I also cannot ping any external IPs. The external IP on the 501 is X.X.190.142 and the GW is X.X.190.137 but for some reason the 501 has "discovered" a GW of X.X.190.136 (which is wrong). I can't seem to remove this route and it doesn't appear below, but here is how I know it's in the 501:

pixfirewall# show route
outside 0.0.0.0 0.0.0.0 X.X.190.137 1 OTHER static
inside 192.168.0.0 255.255.255.0 192.168.0.243 1 CONNECT static
outside X.X.190.136 255.255.255.248 X.X.190.142 1 CONNECT static

Please let me know what you notice out of the ordinary. Thanks!

Here is my config:

Building configuration...
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
pager lines 24
icmp permit X.X.190.136 255.255.255.248 outside
mtu outside 1500
mtu inside 1500
ip address outside X.X.190.142 255.255.255.248
ip address inside 192.168.0.243 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.0.242 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 209.113.190.137 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
aaa authentication ssh console LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh 192.168.0.242 255.255.255.255 inside
ssh timeout 5
console timeout 0
username admin password 0zNll/2ltysWP8oc encrypted privilege 15
terminal width 80
Cryptochecksum:ac40300c03e2f8c81ddebe2d05496f61
: end
[OK]

 

[just2n]

Ok so I'm able to get out to the internet now.

Can someone just review my config and let me know if there is anything out of the ordinary?

Thanks!

- Justin

 

[chucksel]

Looks pretty good to me. What resolved your problem?

Chuck

 

[just2n]

It was so simple I'd rather not say....

However in my haste, it had to do with the console port being so damn close to ethernet0 port. Catch my drift!

Thanks Chuck,

- Justin

 

[chucksel]

Ahhhhhhhhh, yes. Something I'd probably do in my haste as well.

Be well in 2005.

Chuck