topic PIX 525 Multiple Outside Interface in Network Security

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Tue, 12 Mar 2019 00:10:33 GMT

Hi all ,

We are in the process of adding second isp for webhosting purposes .Is there any issue if we are making outside 2 interface on the pix .i need to host some websites through this new link ie isp2 .i had seen lot of suggestions in the forums .I need to confirm and ask some valuable doubts on the suggestions .

PIX Version 7.0(7)

PIX 525 Multiple Outside Interface

Jennifer Halim — Wed, 17 Oct 2012 11:48:39 GMT

No, neither PIX nor ASA supports multiple default routes via more than 1 interface unfortunately. You would need to terminate the second ISP on a router.

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Wed, 17 Oct 2012 12:25:37 GMT

Hi Jeniffer ,

Thanks for the reply .

I am not planning multiple default route to isp1 and isp2 .

Plan

Default route to isp1 and specific route to isp2 .will it work ?

PIX 525 Multiple Outside Interface

Jennifer Halim — Wed, 17 Oct 2012 13:08:43 GMT

Yes, if default route to isp1, and specific route to isp2, that will work.

But how are you going to host websites on isp2 if you don't have a default route to isp2? Isn't the web request coming from any ip addresses on the internet? or will it be coming from specific ip on the internet?

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Thu, 18 Oct 2012 11:03:24 GMT

Hi ,

Thank you for the reply .

web request is coming from any ip to the webserver connected to the isp2.

PIX 525 Multiple Outside Interface

Jennifer Halim — Thu, 18 Oct 2012 11:05:19 GMT

In that case, you can't configure static routes for isp2 because it's coming from any IP on the internet. You would need default route, but as advised earlier, default routes is not supported on multiple interfaces on PIX.

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Thu, 18 Oct 2012 11:49:02 GMT

Hi halim,

Thank you for the reply.Now i understood .You have any solution for connecting second isp to the network for webhosting .

PIX 525 Multiple Outside Interface

Jennifer Halim — Thu, 18 Oct 2012 12:20:04 GMT

Do you happent to have a router in front of the ASA? Maybe you can connect the second isp there if you do.

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Mon, 22 Oct 2012 05:19:33 GMT

Hi halim,

I have connected the second isp to the internet router .And i applied Policy based routing in the interface connected to firewall for outgoing traffic .Everything is working fine .

PIX 525 Multiple Outside Interface

Jennifer Halim — Mon, 22 Oct 2012 05:29:40 GMT

Thanks for the update, much appreciated.

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Mon, 22 Oct 2012 05:32:55 GMT

Hi halim ,

We are now using pix 525 and we are going to replace it .What about the model

ASA5550-BUN-K9 ?

PIX 525 Multiple Outside Interface

Jennifer Halim — Mon, 22 Oct 2012 06:07:08 GMT

Here is the direct replacement for PIX525:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5709/ps2030/end_of_life_notice_cisco_pix_525_sec_app.html

ie: ASA5520.

However, yes, you can definitely go ASA5550, or even the new model of ASA X series which has better specification.

Here is the model comparison for your information:

http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html#~tab-b

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Mon, 22 Oct 2012 06:20:57 GMT

Hi halim ,

Now my ouside interface is 100 mbps internet and last day i got a new link of 1 gbps and also in my network there are 6 zones .Is there any command for seeing the concurrent connections in the pix .Now i am using ids 4215 which is also a old one .I had seen Some new firewall is having ips features also .A firewall with ips or ips box alone is good for the webhosting data centres

PIX 525 Multiple Outside Interface

Jennifer Halim — Mon, 22 Oct 2012 06:34:44 GMT

"show conn" output, and on the first line, it will show you the current connections, as well as the maximum connection.

If you would like an IPS module, you can't use ASA5550, the highest model of ASA that supports the IPS module is ASA5540 on the ASA 5500 series, or alternatively if you are going for the new ASA 5500-X series, no additional module is required as it is built in to the ASA.

Here is the datasheet for your information:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/data_sheet_c78-701808.html

Here is the datasheet for AIP module if you are interested in the 5500 series ASA:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6825/product_data_sheet0900aecd80404916.html

Here is the datasheet for the IPS in the 5500-X series:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/data_sheet_c78_459036.pdf

Hope that helps.

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Mon, 22 Oct 2012 07:24:40 GMT

Thank you for the quick response.

I had exexuted the command

it showing

28250 in use, 29752 most used

UDP out 10.1.14.250:123 in 10.15.254.1:123 idle 0:00:37 flags -

Hope i had lot of connections in the network .

what are the factors that i look for a upgradtion from current pix 525 .How can i make a study .

PIX 525 Multiple Outside Interface

Jennifer Halim — Mon, 22 Oct 2012 08:00:57 GMT

You can grab the output of "show conn" during peak hours (once every 15 minutes) to check what is the maximum connections, but from the above output, it seems that the maximum connections does not exceed 30,000 connections.

You should be able to replace PIX525 with ASA5525-X, and still get a better specification than the existing PIX525.

Here is the datasheet for PIX525:

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5709/ps2030/ps2118/product_data_sheet09186a0080091b09.html

and you can compare it with the ASA5525-X from the above advised URL.

Oh, do you have a requirement for VPN, as PIX525 supports 2000 IPSec VPN tunnels, but ASA5525-X only supports 750 IPsec VPN (but it also supports AnyConnect SSL VPN, and IPS)

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Mon, 22 Oct 2012 12:13:10 GMT

Hi halim ,

Thank you for giving me the continous support .

I have a separate box for vpn connectivity .But it is pix 515e.Once i replaced the pix 525 with a new model .I can use the pix 525 for vpn purposes .So the vpn issue can solve . But my issue is about the throughput of new firewall. I will summarize the peak utilzation of the pix interfaces .

Interface Name In Out

Interface1 55 Mbps 10 Mbps

Interface2 12 Mbps 20 Mbps

Intreface3 80 Mbps 35 Mbps

Intreface4 18 Mbps 70 Mbps

Intreface5 350 kbps 400 kbps

Intreface6 400 kbps 3 Mbps

Interface7failover 0 3.5 Mbps

Do u have any suggestion for the throughput for my new asa .

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Tue, 23 Oct 2012 10:22:08 GMT

Hi jennifer,

Any update on the suggestion .

PIX 525 Multiple Outside Interface

Jennifer Halim — Tue, 23 Oct 2012 10:50:43 GMT

With that throughput, I would suggest the ASA5525-X as that supports maximum of 600 Mbps, which is more than enough for your current throughput utilization.

PIX 525 Multiple Outside Interface

Rajeevan Chaladan — Tue, 23 Oct 2012 11:14:11 GMT

Hi jennifer,

Thank you for the update The data sheet firewall throughput is showing 2 Gbps . Firewall + IPS Services is 600 Mbps. That a good choice .Is there any issue if we using the ips with firewall .You have any link how we can use ips features in asa x series .