hi folks, i have a problem deploying our PIX firewall. the following is our network topology:
(internet Bbone)--(GSR)--(6009)--(Alteon L4 switch)--(4009)--(PIX535&WEB/Email Servers)
[note: Alteon L4 switch is for load balance among servers.]
As far as i know, PIX is usually put between a router and a switch. but in this case, the PIX is not directly connected to the router, rather, ALL of the interfaces of the PIX are connected to the Cat4009 only, there are VLANs presented on the Cat4009. the servers, like the PIX, are also connected the Cat4009 via different VLANs.
my question is: Does the PIX still work in this case? i mean, it seems like all the inbround traffics from the internet can first reach the Email/web servers without the protection of the firewall, because the firewall's position makes it impossible to block any traffic from the outside network. the firewall only works when the servers respond to the inbound traffic, because the PIX can check the returned packets sent by servers.
is this topology all right for a network which need high security? or it doesn't work at all? is there a better solution?
any help will be greatly appreciated, thanx in advance.
