Double pix configuration

[echelon360]

Wondering if you guys can shed some light on this

I have a host (AM1/172.16.25.3) that resides behind PIX A

-interface inside 172.16.x.x security 100

Then i have another host (AM2 /172.16.26.30) that resides behind PIX B

PIX A is Connected to PIX B via interface e3

-i.e

PIX A

interface e3 10.1.1.1

PIX B

-interface e3 10.1.1.2

How do i get AM1 to talk to AM2?

-Simply use statics?

[a.awan]

If you want either host to be able to initiate a session to the other then yes you will need statics for each host on its respective PIX. The static will be between the inside interface and the e3 interface of each firewall. An access-list will be required to be applied inbound to the e3 interface of each firewall basically allowing communication to a host on a more secure interface (inside) from a host on a less secure interface (e3). You might also require routes depending on how you configure the statics (static to the same ip or a different).