Pix 515E

[stephtchoko]

I'm currently work with pix 515E, with Ios version 6.1.I want to know, if this pix firewall can support multiple instance of firewall.

How the configuration o instance of firewall is done ??

How can i configure trunk with vlan ??

regards.

[mpalardy]

Version 7.x is required to do what you need.

It is necessary to upgrade to 6.2 or 6.3 before doing an upgrade to 7.x.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_70/pix_upgd/pixupgrd.htm#wp1752751

Complete configuration documentation for v71 can be found here:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_71/cmd_ref/index.htm

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_71/conf_gd/index.htm

The number of instances (virtual machines) is under licensing. 2 instances basically comes for a PIX-UR. You should check if your 515 meets the minimum hardware requirements to do all this.

HTH

[stephtchoko]

I don't see where the differents instances vlan are configured for pix 515E.

Regards.

[mpalardy]

According to this documentation (see table A2) pix-515e-UR is licensed for a max of 25 vlan's.

http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_1/conf_gd/specs.htm#wp1095332

Mike

[Patrick Iseli]

Virtual firewall, available on PIX 515E UR with PIX OX 7.x, are called context. Without additional license you have 2 integrated in the UR license.

You can purchase an additional license that gives you up to 5 contextes:

Setup examples:

http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_1/conf_gd/contexts.htm

VLAN setup:

http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_1/conf_gd/intparam.htm

sincerely

Patrick

[stephtchoko]

On the document example you send to me, the pix firewall has Gigabiethernet interface.The pix 515 E in my network doesn't have Gigabitethernet interface.

I don't see where the configuration of security policy apply to each vlan.

In fact, i have to configure a instance vlan for each client.

Is it possible to give an interface web for each vlan instance.In this interface web ou other, the client 'll be able to apply its own security policy.

Regards.