re-Design question

[j_finley]

I currently have two Cisco PIX 515’s in failover mode connected to my core switch (C4003). Also on that switch, I have a print server that I need to traffic shape because some customers are getting their link saturated. The customers are printing thru our IPSEC tunnels. The PIX thus far has about 25 tunnels. I need to traffic shape port 9100 and 515 outbound. I understand that I need to do this before it hits the PIX, what’s the easiest and what’s the proper way to do this?

Thanks.

[vkapoor5]

You can either have a VPN concentrator or router before the PIX to terminate all your tunnels and do QoS on it. Its not possible to do traffic shaping in PIX.

[j_finley]

Thanks for the reply. So basically, I take my Router (3640), plug an FE into a HUB, then plug my two PIX's into the same hub (for failover) and then traffic shape on the FE interface going into the hub? I'm just trying to figure out how I will map all my conduits back into my network if I do this since I'll have to re-address things...