PIX as replacement for router?

[tato386]

I am setting up a network in a datacenter where the Internet pipe will be provided to me via a FastEthernet CAT-5 cable. It seems to me that I won't need a router in this case but because this is the first time that I do this I want to be sure. Here is my scenario:

The ISP will provide a FastE connection and a /30 IP block that I will use for the outside (WAN) interface of my PIX. The inside interface if the PIX will use a private 10.0.0.X IP block and be connected to a switch and several servers. The ISP has also provided a /24 block of public address that they will route to my PIX and then I will NAT the public block to the corresponding internal, private IP.

This should work, right? If not, why?

Thanks,

Diego

[mklaphek]

Yes, it should work. But the real issue is to decide what you're trying to accomplish. If your company depends on this data center for its livelihood, then you have to decide how much protection is enough. Many times the back-end SQL servers are the most important asset to protect. If this is the case, I would use a router up fron to block all unnecessary transactions (e.g., all but 80 and 443) and use the PIX to control access to the back-end servers.

[vikrantarora]

but, cant we do the same using PIX as well? How does using a perimeter router increase security? This may be a trivial query, but I just wanted to clear my understanding of the subject.