VLAN's in PIX will work for you sure, all you need to do is like this.
Configure VLAN's on the outside interface , I mean the interface that is
connected to the Internet router.
can change the security level then you need to connect this to a switch
which understands trunking. Refer Cisco documentation on setting up of
vlans in PIX as well switches for better understanding on this.
The reason why I say is that since you have only one physical port and at
the same time, have two vlans, each one representing your ISP assigned IP,
the switch port to which this PIX outside interface connected should be able
to understand both the VLAN packets .
you need to configure that port to be part of both vlans and trunk that.
Also your Internet router should have two interfaces one representing each
of the IP blocks so that each interface represents one ip block for you . In
this case dual ip address will not work because PIX will treat each IP block
as a separate interface.
When you do this , you can have two IP segments get working and of course
you need to do more configuration , like NAT or static for the other range
in your PIX to work as well.
let me know if you need more help on this to understand better :)
_____
From: MOYA Yves [mailto:Yves.MOYA@akerys.fr]
Sent: Wednesday, March 15, 2006 7:55 PM
To: Aaron Rohyans; firewalls@securityfocus.com
Subject: RE : Pix external inteface and multiple IP address - is it
possible?
hello,
I've same problem with a 515E
can I set the outside IP multiple range ?
ip address outside 192.168.100.1 255.255.255.0
and at same time
ip address outside 192.168.200.1 255.255.255.0 ?
I want to do that because my company bought 2 range of public address that
are disjoined
I try VLAN, didn't work...
thanks,
Yves
_____
De: Aaron Rohyans [mailto:aaronr@imcu.com]
Date: mar. 14/03/2006 21:58
À: firewalls@securityfocus.com
Objet : Re: Pix external inteface and multiple IP address - is it possible?
It depends how you want the PIX to "listen" on the IPs. You can only assign
one IP address to the external interface, but you can have the PIX "listen"
on other IP address and statically translate them or map them to an internal
device such as a server. For instance:
**Set the outside IP**
ip address outside 192.168.100.1 255.255.255.240
**Set up static translations for the PIX to "listen" on other IPs**
The first entry tells the PIX to "listen" on 192.168.100.2 and when it
receives data on that IP, translate and send the data to the internal IP of
10.0.10.25
The same goes for the second entry only listening on 192.168.100.3
static (inside,outside) 192.168.100.2 10.0.10.25 netmask 255.255.255.255 0 0
static (inside,outside) 192.168.100.3 10.0.10.25 netmask 255.255.255.255 0 0
Hope this helps!
Aaron
----- Original Message -----
From: "Ade" <adrian.bradshaw@gmail.com>
To: <firewalls@securityfocus.com>
Sent: Tuesday, March 14, 2006 2:49 PM
Subject: Pix external inteface and multiple IP address - is it possible?
This may seem like a silly question, but can the external interface of
a PIX (515) have more than one IP address ?
A company Ive been contracted, have a range of IPs and want some
listening on one port and some on another, but do you think I can find
how to assign multiple IPs to the external intrerface?
I have found some forum posts that say its not possible - but surely
that cant be true?
Thanks, Adrian
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________
____________________________________________________________________________
_
Scanned by Sanmina-SCI eShield
____________________________________________________________________________
_
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________
