topic Re: PIX ISP two subnets in Network Security

PIX ISP two subnets

mikee_p — Fri, 21 Feb 2020 07:54:04 GMT

I have been allocated two non-contiguoius subnets by the ISP, am I right that there is no way to support two subnets on an outside ( e0 ) interface ?

Re: PIX ISP two subnets

federico_caminos — Fri, 28 Jan 2005 19:02:14 GMT

Hello Mikee

It works , you just have to be sure that both

subnets are properly routed to the outside interface by your ISP.

Any static or global/nat configuration statement can use an IP from any of the two subnet ranges.

Be carefull not to use the SUBNET or BROADCAST addresses to make static or global statements.

Re: PIX ISP two subnets

mikee_p — Mon, 31 Jan 2005 10:17:11 GMT

We have tried this with no joy so far, I suspect the outside mask will need to change to allow for both subnets IE class A 0r B in this case even though the ISP subnets are both /29, this may fool the pix and router to see each other.

Re: PIX ISP two subnets

federico_caminos — Mon, 31 Jan 2005 13:30:23 GMT

Have you checked with your ISP , they should be routing both subnets to your outside interface.

What version of PIX OS you have ?

Re: PIX ISP two subnets

federico_caminos — Mon, 31 Jan 2005 14:34:25 GMT

Hello !

I will clarify my previous post , to make it work you have two options depending on how your ISP configured his router.

If they just added a second subnet by configuring a secondary IP to the interface facing your PIX then you have to enable proxy-arp on the outside interface of your PIX ,

no sysopt noproxyarp outside

For the other option you dont need to have proxy-arp enabled but your ISP should "route" the second subnet to your outside PIX address, using this command

route second_subnet subnet_mask outside_PIX_address

Hope this helps ... let me know !

Re: PIX ISP two subnets

carlos.asensio — Thu, 26 Mar 2009 11:04:19 GMT

Hi,

that first option you described is what my ISP have configured.

Do you know if the PIX 6.3 will do proxy arp on its outside interface for a static entry of a IP address which is not in the subnet of the outside?

In my case, it's not working.

Appreciate any help.

Re: PIX ISP two subnets

federico_caminos — Fri, 27 Mar 2009 22:36:51 GMT

Hi,

Yes it should, provided that it is enabled first.

You can enable proxyarp on an interface by configuring the noproxyarp command

no sysopt noproxyarp outside

Hope this helps.