cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
802
Views
0
Helpful
6
Replies

Route in/out same interface on PIX

rate
Level 1
Level 1

Hi,

I was recently told that it is not possible to route traffic coming in via e.g. Eth1 out of Eth1 again to another router for example.

I'm not convinced though, and was wondering if any of you know of a way to do it? It is some special command, a question of rules or simply the need for a firmware update?

Thanks in advance,

Rasmus

6 Replies 6

sachinraja
Level 9
Level 9

Hello Rasmus

You are right... icmp redirects arent possible with PIX.. this is feature specific and does not depend on any commands or hardware...

try putting a router before/after pix and do redirection on router instead of pix...

just have a look at this pix faq document..

HTH

Raj

s309973
Level 1
Level 1

I had the same need a little over a year ago and I opened a TAC case to ask if there were any "undocumented commands" to get the PIX to route packets in/out, for my particular SOHO need. I was advised it was NOT possible. I had to put a router just before the PIX, as has been mentioned in this thread.

timothy.arnold
Level 1
Level 1

Routing packets in/out of the same interface is known as hair-pinning. This is not supported in 6.x or previous versions, but you can enable it on PIX 7.x

HTH

Really? That sounds great. Actually I think it weird they didn't implement it in earlier versions - a lot of other firewalls can do it.

Is it easy to configure, or is it rocket science?

You can enable hair-pinning ONLY for VPN....

sunilc
Level 1
Level 1

Intra-interface firewalling is possible on both FWSM 2.3 amd PIX 7.0 using the 'same-security-traffic permit intra-interface' command.

On the FWSM this can be for any traffic. However on the PIX I beleive this is allowed only for IPSec traffic - VPN Hub-Spoke scenario to allow for spoke-spoke communication after firewalling on same interface.

Review Cisco Networking for a $25 gift card