ip redirect with PIX

[jrhofman]

anyone know if you can have a pix do an IP redirect to a host. I had a situation where hosts have a default to the pix on an inside interface and then the pix had a route to the destination via a router on the same inside interface. This breaks down the 3 way handshake since the SYN Ack from the destination never gets sent back throughthe PIX. It just goes directly to the source host on the same subnet.

[scoclayton]

Nope. The PIX will not work in this design as you want it to. In order for the PIX to pass packets, the ingress and egress interfaces must be different interfaces. In other words, it must be received on one interface and be placed on the send buffer of another interface in order to pass. This behavior is expected and is part of the Adaptive Security Algorithm (ASA) on the PIX.

Your only real option in this case is to change the DG to the router on the inside segment and add a default route on the router pointing back to the PIX.

Hope this helps.

Scott

[jrhofman]

Thanks, That's what I did to fix it but was just curious if I was missing anything in the FW.