since each vlan on the pix is setup as a logical interface, the firewall treats
it as if it were routing traffic from one interface to another even though they
are all connected to the same physical port. So providing your core switch can
handle the vlans and can route the traffic destined from one vlan to the other
to the pix, the pix should be able to handle this.
Thanks,
Alex O. Ostberg
Network Security Specialist - State of Montana
Office: 406.444.4557
Fax: 406.444.2701
Email: aostberg@mt.gov
-----Original Message-----
From: Pablo Hauser [mailto:pablohauser@yahoo.com.ar]
Sent: Friday, January 21, 2005 12:17 PM
To: 'Dimitri'; firewalls@securityfocus.com
Subject: RE: PIX question?
Dimitri, PIX firewall doesn't route traffic between interfaces as
Checkpoint-Nokia does, just NAT it. Not even think about routing in the
same interface... Taking this speech as the bible of PIX troubles, I
really don't think that could work...
But if it does, tell as how!! :)
__________________________________________________
Pablo D. Hauser
Security Operations Center
IMPSAT
-----Mensaje original-----
De: Dimitri [mailto:spy4kr@yahoo.co.kr]
Enviado el: Miércoles, 19 de Enero de 2005 13:47
Para: firewalls@securityfocus.com
Asunto: PIX question?
Hi all,
I'm auditing a PIX config for version 6.3(4). It has an inside and
outside interface only. The inside interface is defined with 1 physical
and 2 logical vlans. These are nat'd to the outside.
We have a series of static routes binding the same ip on each of the
vlans (e.g "static (inside,vlan1) ip1 ip1 netmask ...."). This part I
don't understand very well.
We've defined rules that explicitly permit access to services (eg. SMTP)
from one vlan to another on the same interface. We have a catalyst
switch, if (really big IF) this can force the vlans to route traffic to
the firewall this might actually work. However, I am very sceptical
that this will work and the firewall can actually police traffic between
the vlans. Even if it does it seems unnecessarily complex and subject
to error.
I'd like your opinion on this configuration.
Thanks in advanced.
