PIX and VIPs

From: Karyn Ulriksen (kulriksen@publichost.com)
Date: Wed May 30 2001 - 19:34:48 EDT


I've been using PIX for pretty straight forward 2 interface with or without
NAT to multiple servers for a while. I think that the PIX can also do the
following scenario, but not sure. Can someone confirm?

    ethernet0
    outside [1.1.1.2/24]----\
    global [64.1.x.x/28] \ ethernet1
    global [64.2.x.x/27] -- inside [10.1.1.1/16]
    global [64.3.x.x/29] /
    global [64.4.x.x/29]----/

The goal is to permit virtual IP addresses on servers inside the firewall.
If it makes sense, I would like to elimate NAT and use ipforwarding to route
subnets to primary interfaces behind the firewall.

I have been told that PIXs can only handle one subnet behind a firewall per
inside NIC. However, I have seen diagrams with routers behind the firewall
which leads me to believe that I can forward subnets to a routing device
(such as a router or server loaded with VIPs). Can I still set up conduits
for the VIPs (ie 64.2.x.x/27 forwarded to server x)?

Karyn



This archive was generated by hypermail 2b29 : Sun Aug 04 2002 - 04:12:39 EDT