Hi Robert,
If I understand the network correctly based on the above posts, you have something like this (correct me if I'm wrong):
Internet---Router---(outside)PIX(inside)---VLAN 1
(vlan2)
|
VLAN 2
|
Wireless Router
|
VLAN 3
|
Wireless hosts
Assuming this is correct, the problem happens when wireless hosts (192.168.3.x) talk to VLAN 2 hosts (192.168.2.x), right? So the problem looks like this:
1. 192.168.3.x sends a packet for 192.168.2.x to it's default gateway (the wireless router).
2. The wireless router checks its routing table and sees that it already has an interface in the 192.168.2.x subnet, so it sends the packet directly to the destination. The PIX never sees this initial packet.
3. 192.168.2.x needs to send its response destined to 192.168.3.x. It checks its routing table and sees that it has a default gateway configured on the host that points to the PIX's VLAN 2 interface.
4. The PIX receives the packet but knowing that it never saw the SYN for the connection, it drops the 192.168.2.x host's response and the connection fails.
To fix this, you have a couple of options:
1. Add a static route on the hosts in the 192.168.2.x network that sends all traffic for 192.168.3.x to the Wireless router's interface, instead of the PIX's interface. For example, on MS Windows, this is done with the 'route add' command.
or
2. Add a static route on the Wireless Router that sends all traffic destined for 192.168.2.x to the PIX's interface instead of directly to the hosts themselves. If you choose this option, you also need to enable the 'same-security-traffic permit intra-interface' command on the PIX to allow the packet to enter and leave on the same VLAN 2 interface (this is denied by default). You also need to make sure the packet is allowed by your security policy (ACLs, NAT, etc.)
-Mike
