topic Re: PIX VLAN Question in Network Security

PIX VLAN Question

mike-greene — Fri, 21 Feb 2020 06:55:14 GMT

Hi,

This new PIX VLAN stuff is really cool but I have one quick question. Lets say you have configured the inside interface with 2 VLAN's 20 and 21. Now, does the same hold true about a packet entering an interface cannot leave the same interface? I just want to get this straight that this does not turn the PIX into a router or MSFC if you will. Will it only forward packets entering the inside interface on these VLAN's, out another interface say the outside or the DMZ?

Thanks in advance.

Re: PIX VLAN Question

gfullage — Fri, 08 Aug 2003 03:51:47 GMT

Nope, the old limitation doesn't hold true with VLAN interfaces. You'll be able to send a packet in VLAN 20 and out VLAN 21, even though physically these are the same interface. Logically within the PIX they're completely separate interfaces and treated as such.

Re: PIX VLAN Question

mike-greene — Fri, 08 Aug 2003 10:33:59 GMT

Thanks for the responce..

I wish this did hold true but there are probably 100 reasons why it does not. OK, if thats the case can you apply in-bound and out-bound access lists to the VLAN interface? Can you apply an access list at all to the VLAN?

Thanks..

Re: PIX VLAN Question

mike-greene — Fri, 08 Aug 2003 20:18:28 GMT

Or, if you cannot apply access lists to the logical interfaces, can you control the communication between the vlan's with the security level? I'm going to have to set this up in a lab and let everyone know.

Re: PIX VLAN Question

gfullage — Mon, 11 Aug 2003 01:49:16 GMT

Yes definately, that's the whole point of the PIX thinking they're separate interfaces. Assign security levels just like you would for any dmz interface and assign nat/global or statics/ACL's accordingly to control access between them.

Re: PIX VLAN Question

mike-greene — Mon, 11 Aug 2003 12:05:06 GMT

Thanks for the info!!