On 19 Jan 2005 16:47:03 -0000, Dimitri <spy4kr@yahoo.co.kr> wrote:
I'm auditing a PIX config for version 6.3(4). It has an inside and outside
interface only. The inside interface is defined with 1 physical and 2
logical vlans. These are nat'd to the outside.
We have a series of static routes binding the same ip on each of the vlans
(e.g "static (inside,vlan1) ip1 ip1 netmask ...."). This part I don't
understand very well.
Those aren't static routes, they're static NAT configurations.
Contrary to an earlier post, the PIX *will* route traffic happily.
You just have to tell it what to not NAT.
We've defined rules that explicitly permit access to services (eg. SMTP) from
one vlan to > another on the same interface. We have a catalyst switch, if
(really big IF) this can force > the vlans to route traffic to the firewall
this might actually work.
Not a big if at all, that's not a problem. Just have to setup the
VLAN's properly on the switch and the firewall.
However, I am very
sceptical that this will work and the firewall can actually police traffic
between the vlans.
As far as routing traffic between VLAN's on the same interface, I'm
not sure offhand if the PIX will do that. It will not route any
traffic out the interface it comes in on, regardless of configuration,
but I don't know if that applies to the entire physical interface
(i.e. includes any configured VLAN's).
Even if it does it seems unnecessarily complex and subject to error.
Whether it's unnecessarily complex depends on the environment.
Generally you route between VLAN's with a L3 switch, or occasionally a
router, and rarely a firewall. It definitely adds complexity, which
increases your chances of error and problems. By how much depends on
how skilled your admins are. It definitely increases security.
You'll have to analyze the positives and negatives in the context of
your environment to reach a decision on whether or not it's excessive.
Some reading material:
http://www.cisco.com/en/US/tech/tk389/tk689/technologies_tech_note09186a008009478e.shtml
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800b6e1a.shtml
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aad.shtml
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/s.htm#wp1026694
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/index.htm
Regards,
-Chris
