Re: PIX ROUTE

I would suggest option2.  The PIX firewall is not ideal for routing 
between internal subnets all reachable from a single interface.  By 
selecting the internal router as a gateway for your clients you also 
maintain more internal routing flexibility.  You can create a default 
route on the internal router pointing to the PIX eth1 interface and if 
required tell the router to advertise this default route throughout your 
internal routing domain.

HTH
Stuart





Hesperia DOS-IT Security <itsecurity@hoteles-hesperia.es>
16/02/2005 11:23

 
        To:     firewalls@securityfocus.com
        cc: 
        Subject:        PIX ROUTE


Hi, I am about to make a big change in my network. I will describe the
scenario both scenarios. I have a Cisco PIX 515 connected to a switch 
(using
eth1). The same switch is connected to a router. The router connects me to
WAN, where I have some servers and users. The PIX connects me to Internet
using eth0. The hosts (users computers) have the pix IP (eth1) as the
gateway, because most of the traffic is www. Is it possible to static 
route
WAN connections (coming from eth1), using the same interface (eth1) [see
option1.jpg] ? Is it better to connect the router to the pix (eth2) and 
put
as a gateway the router [see option1.jpg]? Thanks.


Eduardo Di Monte

option1.jpg
Description: JPEG image

option2.jpg
Description: JPEG image