pix best practices

[lalbro]

I am looking for some firepower for a customer that I have. I am wanting to know what the best practices are for ip scheme for the outside network of the pix.

I believe that the outside interface of the pix and the ethernet interface of the router should be on the same subnet. I also believe that the global statements should be within that same subnet.

Currently the customer has the following configured:

outside pix - 192.168.2.2

ethernet router - 192.168.2.1

global (outside) 200.200.200.200

Is this configuration recommened?

[scoclayton]

From a pure security stand-point, the address configuration your customer has is probably better. The only problem that I see is that you are limited in being able to do anything with the PIX outside interface from the internet (ie VPN access, ICMP testing, SSH access, etc...).

Sorry, but I don't think I am giving you the ammunition you wanted.

Scott