Re: Disaster Recovery Question About PIX

smartin · ‎01-07-2003

If your company is like my company getting a single PIX 525 was tough enough, a big "NO" when asking for a failover PIX.

My problem:

Management ask what happens if the PIX systems goes down ?

Currently I have three DMZ's (Web hosting, internal network, remote offices) going through the PIX.

If the PIX went down I would be &^#% because of the routes for each of the interfaces.

Has anybody come up with an affordable solution to "route" the traffic aound the PIX.

gfullage · ‎01-07-2003

I don't see the point in even trying to do what you suggesting. Bypassing the PIX when it goes down is just asking for problems, cause if someone found out about your setup, all they'd have to do is crash the PIX somehow and rather than then have no access to your hosts, they'd have full access. Your asking for trouble even trying to do this, and to be honest I can't think of an automatic way to make this happen, you'd have to manually add in a router or something when the PIX dies.

Your management should be made to understand that if they're not willing to purchase a failover PIX (which by the way is a LOT cheaper than a full-blown PIX), then they're going to have no communication if it goes down. They should also be made to understand that bypassing the PIX is a major security issue that shouldn't even be thought about.

smartin · ‎01-08-2003

Thanks for the response, you wrote "a failover PIX (which by the way is a LOT cheaper than a full-blown PIX)", what does that mean, I have a PIX 525, how can the failover PIX be cheaper?

mpalardy · ‎01-08-2003

A PIX-525 FO Bundle is less than 6k. (I'm not a reseller but it wiil be around that price) + It also requires the same equipment (software and hardware) as the primary unit.

Ask to your management what will be the loss of losing the internet even for a single hour. There's no reason for a serious company not to use a failover unit.

Michael