cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
243
Views
0
Helpful
1
Replies

Second firewall breaks network

rpergola1
Level 1
Level 1

Hello everyone!  Your support section has helped me more times than I can count, but I am completely stumped on this one, and I was hoping someone could offer a possible solution.  This might be a dumb question, and I'm prepared for a dumb answer.

I have been studying for my CCNA, and will be taking the exam in two weeks.  In the midst of my studies, I set up a lab with three switches, a router, an ASA, and a PIX.  I am using a wireless extender as my gateway since I did not want to run a cable from my living room through my kitchen.  This is the topology.  The lab network is 192.168.2.0/24.

ASA 5505(inside) - unmanaged switch - 1841 router - 3550 switch - 2950 switch - (inside)PIX 515E

Both firewalls' outside interfaces go to the wireless extender.  My master plan was to have two networks I could route together, and just generally study the traffic, the OSPF/STP/CDP updates and whatnot.  I realize this is probably a stupid setup, but I got most of this for free, and it also lets me experiment. 

I have network access from the inside to outside through both the PIX and ASA.  The gateway of the network outside of the lab is a Netgear router where I set up a static route so my apartment network (192.168.1.0/24) can reach the lab when I want to.  The route directs 2.x requests to the ASA.

When the PIX is turned off, I can ping from the 1.x network to everything inside the lab.  When it is turned on I cannot.  The router shows the ASA as the highest priority route to the outside regardless of the state of the PIX.  I've messed with NATing and ACLs in the PIX with no luck.  Does anyone know what could possibly be causing this?  Everything inside the lab works with both firewalls turned on.  This is the only thing that seems to break.

Please let me know if you need me to post the configs and I will do so.

1 Reply 1

rpergola1
Level 1
Level 1

Heh, I figured it out, for anyone who has the same obscure situation as me in the future.

The PIX and ASA were listed as equal-cost paths in the router, so it was doing load-balancing between the two.  I was able to fix this by configuring "maximum-paths 1" in the 1841.  This limited the router to forwarding traffic back through the ASA and not the PIX.