topic Re: PIX 515e, multiple VLAN's on one physical DMZ interface in Network Security

PIX 515e, multiple VLAN's on one physical DMZ interface

vantagepointisg — Fri, 21 Feb 2020 08:03:53 GMT

We are trying to set up multiple VLAN's on one physical DMZ interface on a PIX 515e.

The goal is to have separate logical subnets connected to our one, physical, DMZ interface.

Here is what I have tried so far without success:

On switch

-created vlan 30

-added switchports fa0/1 to vlan 30

-connected host 192.168.100.1 into fa0/1

-added switchport fa0/24 to to vlan 1, and vlan 30 with multimode

-connected PIX DMZ interface to switchport fa0/24

-connected host 172.16.1.55 to switchport fa0/10 (vlan 1)

On PIX:

interface ethernet2 auto

interface ethernet2 vlan30 logical

nameif ethernet2 DMZ security50

nameif vlan30 dmz2 security50

ip address DMZ 172.16.1.254 255.255.255.0

ip address dmz2 192.168.100.254 255.255.255.0

Results:

-172.16.1.55 has full connectivity to the PIX and beyond.

-192.168.100.1 cannot ping the PIX at 192.168.100.254 or anything else for that matter.

Any help would be greatly appreciated. I also realize that I could buy a four port NIC and use physical interfaces, but I can't get the purchase approved.

Thanks

Re: PIX 515e, multiple VLAN's on one physical DMZ interface

vantagepointisg — Thu, 07 Apr 2005 13:53:48 GMT

We also are not trunking the VLAN's as we thought that wouldn't be necessary. We would be happy at this point to get the 192.168.100.1 host to ping the PIX at 192.168.100.254.

Thanks

Re: PIX 515e, multiple VLAN's on one physical DMZ interface

mostiguy — Thu, 07 Apr 2005 14:08:28 GMT

Try configuring it as a trunk.

Re: PIX 515e, multiple VLAN's on one physical DMZ interface

jonathanstevens — Thu, 07 Apr 2005 14:31:47 GMT

Have you allowed this on the pix?

icmp permit host 192.168.100.1

Re: PIX 515e, multiple VLAN's on one physical DMZ interface

vantagepointisg — Thu, 07 Apr 2005 15:08:18 GMT

Will a PIX 515e handle ISL trunking?

Re: PIX 515e, multiple VLAN's on one physical DMZ interface

vantagepointisg — Thu, 07 Apr 2005 15:09:34 GMT

Yes all traffic is allowed from this host on this interface.

Re: PIX 515e, multiple VLAN's on one physical DMZ interface

jonathanstevens — Thu, 07 Apr 2005 16:26:56 GMT

I believe PIXs only support dot1q

Re: PIX 515e, multiple VLAN's on one physical DMZ interface

vantagepointisg — Thu, 07 Apr 2005 16:33:34 GMT

That's all that I've found too. I didn't know if they could handle ISL or not. I will make the uplink port on the switch (fa0/24) a dot1q trunk port.

I will let you know how it goes.

Thanks

Re: PIX 515e, multiple VLAN's on one physical DMZ interface

tonyam98 — Thu, 07 Apr 2005 19:43:15 GMT

Creating VLANs on Ethernet1

We want to create one new VLAN interface - VLAN30 and call it DMZ2. Also assign security level 50 to it.

Step 1: Create a Physical Interface:

pix(config)# interface ethernet1 vlan2 physical

Step 2: Name the Interface and set the Security Level:

pix(config)# nameif ethernet1 inside security100

Step 3: Assign IP Address to the interface:

pix(config)# ip address inside 192.168.1.1 255.255.255.0

Step 4: Create the Logical Interface:

pix(config)# interface ethernet1 vlan30 logical

Step 5: Name the Interface and set the Security Level:

pix(config)# nameif vlan30 DMZ2 security50

Step 6: Assign IP Address to the interface:

pix(config)# ip address DMZ2 192.168.100.254 255.255.255.0

Step7. On Switch , set the port where the physical interface the inside, for trunking ISL or dot1q. place the trunking in the native vlan2 like in step 1.

Re: PIX 515e, multiple VLAN's on one physical DMZ interface

vantagepointisg — Thu, 07 Apr 2005 23:38:40 GMT

Works like a champ! I also found this which was helpful.

http://www.ciscotaccc.com/security/showcase?case=K10055697