RE: PIX question?

Dimitri, PIX firewall doesn't route traffic between interfaces as
Checkpoint-Nokia does, just NAT it. Not even think about routing in the
same interface... Taking this speech as the bible of PIX troubles, I
really don't think that could work...

But if it does, tell as how!! :)
 
__________________________________________________

Pablo D. Hauser

Security Operations Center
IMPSAT

 
 
 



-----Mensaje original-----
De: Dimitri [mailto:spy4kr@yahoo.co.kr] 
Enviado el: Miércoles, 19 de Enero de 2005 13:47
Para: firewalls@securityfocus.com
Asunto: PIX question?




Hi all,

I'm auditing a PIX config for version 6.3(4).  It has an inside and
outside interface only.  The inside interface is defined with 1 physical
and 2 logical vlans.  These are nat'd to the outside.   

We have a series of static routes binding the same ip on each of the
vlans (e.g "static (inside,vlan1) ip1 ip1 netmask ....").  This part I
don't understand very well. 

We've defined rules that explicitly permit access to services (eg. SMTP)
from one vlan to another on the same interface. We have a catalyst
switch, if (really big IF) this can force the vlans to route traffic to
the firewall this might actually work.  However, I am very sceptical
that this will work and the firewall can actually police traffic between
the vlans.   Even if it does it seems unnecessarily complex and subject
to error.   

I'd like your opinion on this configuration.

Thanks in advanced.