Pix 515e and ISA 2004

[owlhousing]

Hi all,

I have a decision to make regarding our PIX515e.

We have the DMZ bundled PIX.

I have been considering setting up the following configuration.

internet>pix>dmz>Front End Exchange>Internal Exchange

However every where I look the advice is not to use this configuration and instead to use an ISA Server.

I can only afford 1 new server. And I got the pix because it has a dmz.

Do you guys recommend using a pix and ISA? It seems like a lot of expense. We are a small company with about 300 employees.

What is youre advice? Thanks

Rgs

Colin

[jmia]

Colin,

Form experience, I would place the mail server on the DMZ but saying this I also have PIX and ISA servers. But I would place the mail server on the DMZ and patch everything up for the server.

Here's a URL on setting up mail server access on DMZ with PIX.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008015efa9.shtml

Let me know if this helps a little or require further help.

Jay

[owlhousing]

Thanks Jay,

A voice of reason at last!

I can see the benefit of application level filtering that ISA offers but how many firewalls is enough?

I guess MS will soon be saying that you only require ISA and no form of PIX etc.

Thanks again

Colin

[jmia]

Colin,

To be honest, I would rather have a hardware based firewall protecting my network (PIX) then having an application based system (ISA). Have seen far too much horror scenarios with ISA!!

But I am sure that MS guys will disagree with this… as always.

Jay

[adekugm]

Hi Jay,

Is it possible you could please post your Pix config as I also need to set up my Pix with the ISA server in the DMZ.

The MS guys here have said the Proxy server requires 2 interfaces and as my Pix 515E has 6 interfaces, I was quite happy to have a 2nd DMZ interface for the second nic on the proxy.

The problem I'm having at the moment is getting the connectivity sorted i.e from previous posts I read that one of the proxy cards should be patched into the dmz switch and the other card should be patched into the switch on the inside interface.

I am reluctant to implement this as I feel it breaches the network security.

I want the proxy on the DMZ totally segregated from the rest of the network so if it gets hit by viruses or such, we can simply shut the interface down to stop the flow.

I would want the inside users to connect to the outside interface via the proxy card on dmz interface and traffic from the outside should only connect to the proxy address on the 2nd dmz interface?????? does this make any sense??

I would appreciate some response to this post as while this has been a background project for a while and I have not spent much time on it, I really need to deliver within the next fortnight or so.

Thanks for your time.