topic Hi Madona,I guess management in Network Security

PIX 525 / full throughput ? help please

madonamadona — Tue, 12 Mar 2019 04:20:30 GMT

Dear all,

I started in a new company and they have 2 x PIX 525 (fail over scenario).

The company had a link speed of 100 Mbps and now they upgraded to 1 Gbps, there is a plan to replace the PIX’s with ASA 5550.

But now I have to use the PIX’s but need to use as much as possible of the bandwidth (using the complete throughput of about 330 Mbps).

Both Pix’s have the standard interfaces (2x Ethernet /0/1 and 2x Gigabit 0/1).

The config of the interfaces is as follows:

Eth 0 : outside

Eth 1 :Sync

Gig 0 : management

Gig 1 : failover

I have 2 x Cisco PIX-1GE-66 PIX Firewall 66 Ethernet cards and would like to add them to both Pix’s (if they help to get the full throughput).

Now, what is the best config to achieve this? Which interface of the above 4 should I connect to the new 1GE card? Or what’s the best to do to get the full throughput?

I need to finish this within 1-2 days.

I would appreciate any help.

Thanks in advance

Madonamadona

Hi Madona,As per my knowledge

nkarthikeyan — Wed, 18 Jun 2014 06:33:05 GMT

Hi Madona,

As per my knowledge you can split the interface & traffic based on the load. Obviously Inside Segment & Outside segment will have the more load than the other. You can split that in to two different cards ( PCI Bus) so that you can gain the maximum throughput. This will prevent you from getting the overrun / under run error and cpu utilization issues.

HTH

Regards

Karthik

Many thanks for your reply,

madonamadona — Wed, 18 Jun 2014 07:28:33 GMT

Many thanks for your reply, you are a star. Will try it. I am new in firewalling and I didn't configure the existing fws. Which port is the inside one do you think? As it's not described in the config. many thanks madonamadona

Hi Madona,I guess management

nkarthikeyan — Wed, 18 Jun 2014 07:36:32 GMT

Hi Madona,

I guess management would be your inside interface. You can get to know that the interface which connects to your LAN would be the inside. That i cannot assure you. You can check the interface which connects to your LAN and find it out.

HTH

Regards

Karthik

Due to overhead on the

Marius Gunnerud — Wed, 18 Jun 2014 07:38:17 GMT

Due to overhead on the packets you will never get the full throughput that is advertised with the device...just so that is clear.

Other than that, I would agree with what Karthik has suggested and split the traffic between the two cards (for inside and outside traffic).

Please remember to select a correct answer and rate helpful posts

Many thanks to you all, will

madonamadona — Wed, 18 Jun 2014 18:08:27 GMT

Many thanks to you all, will give it a try and then report back.

Thanks again

Madonamadona

Many thanks to you all, will

madonamadona — Wed, 18 Jun 2014 18:09:54 GMT

Many thanks to you all, will give it a try and then report back.

Thanks again

Madonamadona

The interface name should be

Marius Gunnerud — Wed, 18 Jun 2014 18:15:54 GMT

The interface name should be in the configuration but it will not be under the interface sub-commands. If you want help identifying it please post your full running config (sanitised).