topic Re: PIX 515 - Multiple Subnets in Network Security

PIX 515 - Multiple Subnets

comoms_dot_com — Fri, 21 Feb 2020 08:16:00 GMT

Can I have a /28 and a /24 both allocated into one PIX 515e? My current configuration is setup for the /28 and I would like to keep that address space just as it is and then add the /24 if possbile.

Thanks!

Re: PIX 515 - Multiple Subnets

umedryk — Mon, 18 Jul 2005 17:57:30 GMT

Yes, you can add /24 along.

Re: PIX 515 - Multiple Subnets

comoms_dot_com — Mon, 18 Jul 2005 20:30:35 GMT

Can you please list the commands to this post that one would use to add a second subnet to their PIX? I have searched and searched and have not been able to come up with that information.

Thanks!

Re: PIX 515 - Multiple Subnets

jackko — Mon, 18 Jul 2005 21:10:18 GMT

"Can I have a /28 and a /24 both allocated into one PIX 515e?", do u mean a secondary ip on the same interface?

if yes, then i believe it's not feasible.

Re: PIX 515 - Multiple Subnets

comoms_dot_com — Mon, 18 Jul 2005 22:04:51 GMT

"do u mean a secondary ip on the same interface?"

I currently have a /28 setup in my PIX.

The outside interface is xx.185.xxx.xxx

The inside interface is 192.168.1.1

I am using NAT to translate my public addresses from the outside to the inside.

I have run out of addresses in my /28 so I requested a /24 and have just recieved them from my provider. Being that I have been using this /28 for some time and I am in full production I do not want to get rid of those addresses and they are not somewhere in the range of addresses in my /24.

What I am hoping to be able to do is to add this second subnet to my PIX and translate both subnets to my inside addresses.

Can this be done?

Thanks for all of your help!

Re: PIX 515 - Multiple Subnets

jackko — Mon, 18 Jul 2005 23:57:26 GMT

assuming the pix interface is not capable for a secondary ip.

an alternative would be to implement a router before or after the pix performing NAT

another alternative is to use dynamic dns such as dyndns.org

Re: PIX 515 - Multiple Subnets

meenakshi — Tue, 19 Jul 2005 08:18:05 GMT

Hi,

you can configure PIX interface as trunk. Now you can assign multible address for the same interface like your conventional 802.1q trunking. This feature supported only above version 6.3. You can ref. below faq.

http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2030/products_qanda_item09186a0080094874.shtml

VMSundaram

Re: PIX 515 - Multiple Subnets

comoms_dot_com — Tue, 19 Jul 2005 20:01:53 GMT

I can not login with my username and password to that link.

Re: PIX 515 - Multiple Subnets

jackko — Tue, 19 Jul 2005 22:46:08 GMT

thanks for the info meenakshi!

according to the doco:

Step 1 Assign the interface speed to a physical interface by entering the following command:

interface ethernet0 auto

Step 2 Assign VLAN2 to the physical interface (ethernet0) by entering the following command:

interface ethernet0 vlan2 physical

By assigning a VLAN to the physical interface, you ensure that all frames forwarded on the interface will be tagged. VLAN 1 is not used because that is the default native VLAN for Cisco switches. Without the physical parameter, the default for the interface command is to create a logical interface.

Step 3 Create a new logical interface (VLAN3) and tie it to the physical interface (ethernet0) by entering the following command:

interface ethernet0 vlan3 logical

This will allow the PIX Firewall to send and receive VLAN-tagged packets with a VLAN identifier equal to 3 on the physical interface, ethernet0.

Step 4 Configure the logical and physical interfaces by entering the following commands:

nameif ethernet0 outside security0

nameif vlan3 dmz security50

ipaddress outside 192.168.101.1 255.255.255.0

ipaddress dmz 192.168.103.1 255.255.255.0

Re: PIX 515 - Multiple Subnets

jackko — Tue, 19 Jul 2005 23:42:57 GMT

tested the code after posting it.

it seems like the feature works with vlan only, that means it cannot be used as a stand-alone logical interface.

thus it doesn't help with the posted scenario, unless you setup a vlan outside the pix which may not be feasible

Re: PIX 515 - Multiple Subnets

wanghmk1223 — Fri, 05 Aug 2005 06:25:12 GMT

Hi VMSundaram,

But how can insert a failover pix in this senario using only a single L2 switch with 802.1q trunk to primary pix and failover pix?

Re: PIX 515 - Multiple Subnets

maraz — Fri, 05 Aug 2005 06:37:41 GMT

Hello,

I think the solution is more simple than you think. You can use your new address-range with nat, global and statics without actually configure it on the physical interface. That way you can use your new address-space. Your ISP have to route your new network to your PIX outside interface. That is all.

Best Regards

Robert Maras