Search:  

 
 
   All FAQsSite FAQDSL FAQCable TechAbout DSLDistanceCLECSDSL Hurdles»»






how-to block ads



Search for: in all FAQs
FAQ RevisionsEditors: skj See Profile, Covenant See Profile, aryoba See Profile, Phraxos See Profile
Last modified on 2009-11-27 07:30:01

50.3 Router-PIX Combo

·Setting Up Network With Router and Firewall
·Internet - Router - PIX/ASA - LAN
·Internet - PIX/ASA - Router - LAN
·Separate ISP: One is for Internet and one is for VPN
Prerequisite Suggested Reading
»Cisco Forum FAQ »Basic Internet Firewall ACL for Routers without IOS image Firewall feature

Which should face the ISP?

You have a router and firewall in separate device. You review the possibility of setting the network:

1st Setup: ISP -- Router -- Firewall -- LAN
2nd Setup: ISP -- Firewall -- Router -- LAN

When there is an external modem to connect to the ISP, the modem is probably giving an Ethernet hand off. With this in mind, then it is possible to have the 2nd setup.

Several situations that might prevent you to have the 2nd setup are

* There is no external modem, and you have to use the integrated modem within the router
* Your ISP requires PPPoA which your firewall is unable to support

When your situation falls within one of the above, then you have to have the 1st setup.

You Have The 1st Setup And Firewall Needs To Receive Public IP Address

There are several possibilities to setup

* Set a static NAT/PAT between the router and the firewall
* Set the router to be a bridge/modem

Setting up a router as a bridge/modem might "downgrade" your router. Whenever possible, you then should consider setting static NAT/PAT between the router and firewall.

Case Studies

The 1st Setup: Router in front of Firewall

1. Router with integrated T1 modem terminates T1 circuit

This is using the 1st setup where the router is terminating T1 circuit with the ISP. In this case, the router is Cisco with integrated T1 modem and the firewall is PIX Firewall. This case study assumes that you have /29 IP block from your ISP where you can use one IP address for the router and another IP address for the PIX Firewall.

Router Configuration

no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
logging buffered 4096 debugging
no logging console
!
clock timezone est -5
no aaa new-model
ip subnet-zero
no ip source-route
ip cef
!
!
no ip domain lookup
!
no ip bootp server
!
!
!
!
!
interface FastEthernet0/0
description LAN Interface
ip address 192.168.100.1 255.255.255.252
ip nat inside
no ip redirects
no ip unreachables
no ip proxy-arp
no ip mroute-cache
speed 100
full-duplex
!
interface Serial0/0
description WAN Interface
ip address 198.131.65.2 255.255.255.248
ip nat outside
no ip redirects
no ip unreachables
no ip proxy-arp
ip load-sharing per-packet
no ip mroute-cache
fair-queue
service-module t1 timeslots 1-24
!
no ip http server
ip classless
ip route 0.0.0.0 0.0.0.0 198.131.65.1
ip route 192.168.101.0 255.255.255.0 192.168.100.2
!
ip nat inside source list 10 interface Serial0/0 overload
ip nat inside source static 192.168.100.2 198.131.65.3
!
!
no cdp run
!
line con 0
line aux 0
line vty 0
login
line vty 0 4
login
!
!
end

PIX Firewall Configuration

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password ***** encrypted
passwd ***** encrypted
hostname PIX
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
pager lines 24
logging on
logging trap informational
mtu outside 1500
mtu inside 1500
ip address outside 192.168.100.2 255.255.255.252
ip address inside 192.168.101.2 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
nat (inside) 0 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 192.168.100.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80

Description

    •Public IP subnet is configured only on the router WAN side. The router LAN and PIX Firewall intefaces are using Private IP subnets
    •There is static NAT on the router in place between available Public IP address and the PIX Firewall outside interface to set the Firewall of "receiving" Public IP address
    •The LAN machines uses the router WAN interface to go out to the Internet

2. Router as PPPoA client to the ISP

This is using the 1st setup where the router is doing PPPoA as the ISP requirement to connect to the Internet. In this case, the router is Cisco with integrated DSL modem and the firewall is PIX Firewall. This case study assumes that you have /29 IP block from your ISP where you can use one IP address for the router and another IP address for the PIX Firewall.

Router Configuration

version 12.1
!
service timestamps debug datetime msec
service timestamps log datetime msec
!
hostname R1
!
ip subnet-zero
!
interface Ethernet0
ip address 198.131.65.2 255.255.255.248
no ip directed-broadcast
no ip mroute-cache
!
interface ATM0
no ip address
no ip directed-broadcast
no ip mroute-cache
no atm ilmi-keepalive
pvc 1/150
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
hold-queue 224 in
!
interface Dialer0
ip address unnumbered Ethernet0
no ip directed-broadcast
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname username

ppp chap password password

!
ip classless
!
ip route 0.0.0.0 0.0.0.0 Dialer0
!
dialer-list 1 protocol ip permit
!
end

PIX Firewall Configuration

PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password ***** encrypted
passwd ***** encrypted
hostname PIX
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 198.131.65.3 PUBLIC_IP_01
name 192.168.100.1 WEB_SERVER_01
name 192.168.100.2 FTP_SERVER_01
name 192.168.100.3 MAIL_SERVER_01
name 192.168.100.4 TERMINAL_SERVER_01
name 192.168.100.5 SYSLOG_SERVER_01
object-group icmp-type ICMP-INBOUND
description Allowable inbound ICMP traffic
icmp-object echo-reply
icmp-object unreachable
icmp-object time-exceeded
object-group service PUBLIC_SERVER-TCP tcp
description Allowable inbound TCP traffic
port-object range ftp-data ftp
port-object eq smtp
port-object eq www
access-list INBOUND permit icmp any host PUBLIC_IP_01 object-group ICMP-INBOUND
access-list INBOUND permit tcp any host PUBLIC_IP_01 object-group PUBLIC_SERVER-TCP
pager lines 24
logging on
logging trap informational
logging host inside SYSLOG_SERVER_01
mtu outside 1500
mtu inside 1500
ip address outside PUBLIC_IP_01 255.255.255.248
ip address inside 192.168.100.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location TERMINAL_SERVER_01 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface www WEB_SERVER_01 www netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp-data FTP_SERVER_01 ftp-data netmask 255.255.255.255 0 0
static (inside,outside) tcp interface ftp FTP_SERVER_01 ftp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface smtp MAIL_SERVER_01 smtp netmask 255.255.255.255 0 0
access-group INBOUND in interface outside
route outside 0.0.0.0 0.0.0.0 198.131.65.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http TERMINAL_SERVER_01 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet TERMINAL_SERVER_01 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80

Description:

Step 1: Basic Router Configuration

    • Do not setup router LAN or PIX Firewall outside interfaces yet; just the router Dialer interface
    • If you can setup the Dialer interface with static IP address without using the "ip negotiated", you can skip this Step 1. If you have to use the "ip negotiated", keep reading
    • Set the Dialer interface with the proper public IP address and the gateway using "ip negotiated" and "ip route" pointing to Dialer interface. Use the ipcp command to set the default gateway when possible
    • Do "show ip route" to find out the Dialer public IP address and gateway (the ISP equipment IP address)

Step 2: Configure LAN interfaces

    • Move the Dialer public IP address to the Ethernet interface and set the Dialer as "ip unnumbered Ethernet"
    • Configure the PIX Firewall outside interface using the next available public IP address
    • Set the default gateway pointing to the ISP equipment IP address


feedback form

by aryoba See Profile
last modified: 2008-08-12 15:34:49

Suggested prerequisite reading:

»Cisco Forum FAQ »Router configuration to run server (with and without port forwarding)
»Cisco Forum FAQ »PIX Firewall/ASA configuration to run server (with and without port forwarding)

Introduction

Following the same concept of just having single Internet gateway, there is typically NAT/PAT consideration. As mentioned on the reading above, you must use Internet-routable (Public) IP address to go out to the Internet. Therefore there should be NAT/PAT process that translate Private IP address into Public IP address.

Since in this case there are two devices (router and ASA or PIX firewall), you must choose to use one to do such NAT/PAT process. When you decide to have the router to do the NAT/PAT, then Sample Configuration 1 is a good place to start. When you decide to have the ASA or PIX firewall to do the NAT/PAT, then Sample Configuration 2 and 3 are good places to start.

In addition, you also need to have proper IP routing in place to intercommunicate the Internet (ISP), router, firewall, and LAN users. As for any routing implementation, basically each device and subnet must know how to reach other device or other subnet. For simple network, static routes should do the job. For more complex network such as Sample Configuration 3, the router might need to run dynamic routing with ISP routers.

As noted, the above links are suggested prerequisite reading since this sample configuration presents the next chapter of the prerequisite reading. In addition, you must have a familiarity of both older PIX OS commands and newer PIX/ASA OS commands; or at least familiar enough with the older PIX OS commands to configure PIX/ASA running newer OS commands. If you are new to CLI specifically for router, PIX, and ASA; then check out the following FAQ for info.

»Cisco Forum FAQ »The most straight-forward way to configure Cisco router: Introduction to CLI
»Cisco Forum FAQ »Straight-forward way to configure Cisco PIX Firewall/ASA: Introduction to CLI

1. One exit to ISP, Router performs NAT/PAT, PIX/ASA performs no NAT/PAT

This sample configuration assumes the followings:

* You have one ISP providing single path to your router
* You set the router to do the NAT/PAT and basic firewall, where you leave the PIX to do the stateful firewall.
* There is one ISP IP blocks you receive; the 1.1.0.0/30 where 1.1.0.1 is the default gateway and you use 1.1.0.2 (the only usable Public IP address for all servers and other machines in your LAN)
* You are running servers visible to the public
* The servers are web, mail, and ftp
* Your internal web server IP address is 10.10.11.2
* Your internal ftp server IP address is 10.10.11.3
* Your internal mail server IP address is 10.10.11.4
* You use 1.1.0.2 to be your three server's public IP address (static PAT)
* You use a range of 1.0.1.30 to 1.0.1.254 to be your LAN workstations' public IP address (dynamic NAT and PAT)
* You permit only internal host of 10.10.11.5 to telnet and to pdm to the PIX
* Internal hosts are receiving IP address automatically (as DHCP clients) from the PIX
* Since the PIX outside interface subnet is /30, there would be no other IP-based hosts between the PIX and the router within the same subnet

Router Configuration


PIX Firewall Configuration


2. Single exit to ISP, Router performs no NAT/PAT, PIX/ASA performs NAT/PAT and is as the IPSec VPN Concentrator

This sample configuration assumes the followings:

* You have one ISP providing single path to your router
* You set the PIX/ASA to do the NAT/PAT, the stateful firewall, and IPSec VPN Concentrator
* There are two ISP IP blocks you receive. One is the 1.1.0.0/30 where 1.1.0.1 is the default gateway and you use 1.1.0.2 as your router WAN interface IP address. The second IP block is 1.0.1.0/24 where IP address within this subnet will be the server Public IP addresses, router LAN interface IP address, and PIX Outside interface IP address
* You are running servers visible to the public
* The servers are web, mail, and ftp
* Your internal web server IP address is 10.10.11.2
* Your internal ftp server IP address is 10.10.11.3
* Your internal mail server IP address is 10.10.11.4
* You use 1.0.1.3 to be the web server's public IP address (static NAT)
* You use 1.0.1.4 to be the ftp server's public IP address (static NAT)
* You use 1.0.1.5 to be the mail server's public IP address (static NAT)
* You use 1.0.1.254 to be your LAN workstations' public IP address (dynamic PAT)
* You permit only internal hosts of 10.10.8.0/24 to telnet and to pdm to the PIX and router
* The remote users will VPN in using specific Group Authentication credential, which in this sample configuration is Admin as the Group Name and is ******** as the Group Password as indicated on the vpngroup Admin password ******** command
* The VPN users log in as Admin receive IP address within the admin range from 192.168.0.1 to 192.168.0.254.
* No external AAA (Authentication, Authorization, and Accounting) server as the TACACS+/RADIUS server
* Telnet attempt to the PIX/ASA itself is not authenticated

Router Configuration


PIX Firewall Configuration


More Sample Configurations of Setting Up ASA/PIX Firewall as Internet Firewall and IPSec VPN Concentrator
»Cisco Forum FAQ »Configure PIX/ASA as both Internet Firewall and VPN Concentrator

3. Multiple exit to ISP (Failover Routing), Router performs no NAT/PAT, PIX/ASA performs NAT/PAT

This sample configuration assumes the followings:

* You have one ISP providing multiple path to your router
* There is SLA between you and ISP in providing failover routing mechanism
* You set the PIX to do the NAT/PAT and to provide stateful firewall features, where you leave the router to do the failover routing (source routing).
* There are two ISP IP blocks you receive; the 1.0.0.0/24 and the 1.0.1.0/24
* The ISP path #1 subnet is 1.1.0.0/30 where the 1.1.0.2 is on your side
* The ISP path #2 subnet is 1.1.0.4/30 where the 1.1.0.6 is on your side
* Both 1.1.0.1 and 1.1.0.5 are on the ISP router that serve as your default gateway to the Internet
* ISP router is set to use path #1 primary to reach the 1.0.0.0/24; and to use path #2 as alternate
* Likewise, the ISP router is set to use path #2 primary to reach the 1.0.1.0/24; and to use path #1 as alternate
* The network visible to your ISP are only the ones that they assign to you, which are the 1.1.0.0/29 and the 1.0.0.0/23. Other IP addresses or subnets are internal and are only visible to your network
* You are running servers visible to the public
* The servers are using 1.0.0.0/24 block and the workstations are using 1.0.1.0/24 block
* The servers are web, mail, and ftp
* Your internal web server IP address is 10.10.11.2
* Your internal ftp server IP address is 10.10.11.3
* Your internal mail server IP address is 10.10.11.4
* You use 1.0.0.3 to be your three server's public IP address (static PAT)
* You use a range of 1.0.1.1 to 1.0.1.254 to be your LAN workstations' public IP address (dynamic NAT and PAT)
* You permit only internal host of 10.10.11.5 to telnet and to pdm to the PIX
* Internal hosts are receiving IP address automatically (as DHCP clients) from the PIX
* Since the PIX outside interface subnet is /30, there would be no other IP-based hosts between the PIX and the router within the same subnet

Router Configuration


PIX Firewall Configuration


Note:
This is just a sample configuration and not intended as working configuration on any network design. Your actual failover routing mechanism might be different than is suggested here due to the SLA between you and your ISP.

4. Single exit to ISP, dual PIX/ASA performs Active/Active or Active/Standby

PIX/ASA: Active/Active Failover Configuration Example
PIX/ASA: Active/Standby Failover Configuration Example

feedback form

by aryoba See Profile
last modified: 2009-07-27 13:24:09

Suggested prerequisite reading:

»Cisco Forum FAQ »Router configuration to run server (with and without port forwarding)
»Cisco Forum FAQ »PIX Firewall/ASA configuration to run server (with and without port forwarding)

Introduction

Following the same concept of just having single Internet gateway, there is typically NAT/PAT consideration. As mentioned on the reading above, you must use Internet-routable (Public) IP address to go out to the Internet. Therefore there should be NAT/PAT process that translate Private IP address into Public IP address.

Since in this case there are two devices (router and ASA or PIX firewall), you must choose to use one to do such NAT/PAT process. Typically you want to have the ASA or PIX firewall to do the NAT/PAT process, especially when you do have the ASA or PIX firewall facing the Internet (ISP) directly.

In addition, there must be proper IP routing in place between devices and subnets. This way; the ISP, ASA or PIX firewall, router, and LAN users know how to reach each other and other subnets. For simple network, static routes as shown in the sample configuration should suffice.

As noted, the above links are suggested prerequisite reading since this sample configuration presents the next chapter of the prerequisite reading. In addition, you must have a familiarity of both older PIX OS commands and newer PIX/ASA OS commands; or at least familiar enough with the older PIX OS commands to configure PIX/ASA running newer OS commands. If you are new to CLI specifically for router, PIX, and ASA; then check out the following FAQ for info.

»Cisco Forum FAQ »The most straight-forward way to configure Cisco router: Introduction to CLI
»Cisco Forum FAQ »Straight-forward way to configure Cisco PIX Firewall/ASA: Introduction to CLI

Consideration

Typical network environment that might utilize following sample PIX configuration is as follows

* There is a modem in front of the PIX, which the modem connects to the ISP
* ISP is providing Public IP address to the PIX statically
* There is NAT/PAT in place on the PIX to translate internal IP addresses to the ISP-provided Public IP address
* The router behind the PIX is directly connected physically to the PIX LAN (inside) interface using crossover patch cable
* No devices (workstations, servers, switches, hubs) are sitting between the PIX and the router
* All the switches, workstations, and servers are sitting behind the router
* The router is acting as DHCP server, which provide dynamic IP info for hosts behind the router
* The router is not able to provide stateful firewall protection; hence PIX is setup in front of the router before connecting to the ISP (the modem) to protect your LAN from unauthorized accesses

This sample configuration assumes the followings:

* You receive a static IP address from ISP as 1.1.1.2
* The ISP default gateway is 1.1.1.1
* You are running servers visible to the public
* The servers are web, mail, and ftp
* Your internal webserver IP address is 192.168.100.1
* Your internal ftp server IP address is 192.168.100.2
* Your internal mail server IP address is 192.168.100.3
* You have syslog server with IP address of 192.168.100.5
* You use 1.1.1.2 (the PIX outside interface IP address) to be your three server's public IP address (static PAT)
* You permit only internal host of 192.168.100.4 to telnet and to pdm to the PIX
* Internal hosts are receiving IP address automatically (as DHCP clients) from the router
* Since the PIX inside interface subnet is /30, there would be no other IP-based hosts between the PIX and the router within the same subnet

PIX Configuration


Router Configuration


Note:

* The PIX Firewall Inside and Router FastEthernet0 interfaces are within 10.0.0.0/30 network. This means there are no other devices within such network beside the PIX and the router. Sometimes there are other machines within this network where the PIX Inside and Router FastEthernet0 interfaces connect to a switch using straight-through cables. Other machines such as servers connect to the same switch. Since there are more devices, then typically the network is /24 size or larger (i.e. 10.0.0.0/24).

When this is the case, make sure that all of those machines have default gateway of 10.0.0.2 (the Router FastEthernet0 interface IP address) and not the 10.0.0.1 (the PIX Firewall Inside interface IP address). This way all the machines have ability to reach both any machines within 192.168.100.0/24 (the Inside LAN) and the Internet.

feedback form

by aryoba See Profile
last modified: 2009-07-27 13:24:43

Background

* PIX1/ASA1 establishes site-to-site IPSec VPN tunnels over ISP2 with PIX2/ASA2 and PIX3/ASA3
* Internet traffic goes through Router
* Catalyst 3560 Switch is a Layer-3 capable Switch
* There are a couple of Layer-2 Catalyst 2950 switches as access switches
* Only Router, PIX/ASA, and access switches connect to Catalyst 3560 Switch
* All hosts (servers, PC, printers, etc.) connect to access switches
* There is VLAN 7 as Network Management VLAN to deal with Router and PIX/ASA management (10.1.0.0/24)
* There is a separate VLAN 11 as Production VLAN for hosts (10.1.1.0/24)
* Router management IP address is 10.1.0.7 and PIX/ASA management IP address is 10.1.0.5
* Similarly, Remote Site 2 IP subnets are 10.2.0.0/24 as Network Management VLAN and 10.2.1.0/24 as Production VLAN
* Remote Site 3 IP subnets are 10.3.0.0/24 as Network Management VLAN and 10.3.1.0/24 as Production VLAN

Objective

* Traffic between local network behind the 3560 switch and remote sites go through PIX1/ASA1, PIX2/ASA2, and PIX3/ASA3 (via the IPSec VPN tunnel)
* Internet traffic go through Router
* Catalyst 3560 Switch is to be a Core Switch, controling Layer-2 and Layer-3 network management of VLAN 7 and VLAN 11
* From Layer-2 perspective, only VLAN 11 exists at access switches. VLAN 7 as Network Management VLAN exists at Core and access switches
* From Layer-3 perspective, both VLAN 7 and 11 interfaces exist at Core switch to do the routing and Layer-3 switching (as internal router)

Network Diagram

== IPSec VPN ==
ISP1 ---- Router ---- Catalyst 3560 Switch ---- PIX1/ASA1 ---- ISP2 ----- PIX2/ASA2
| | | | |
Trunks | | | | Trunks |
Catalyst Catalyst |
2950 2950 PIX3/ASA3
Switch 1 Switch 2

Network Design

The 3560 Switch
* Set the 3560 switch as Core Switch running both Layer-2 and Layer-3 functionality
* There will be trunks between the Layer-2 switches and this 3560
* The 3560 will be doing routing (the Layer-3 functionality) and act as internal router
* As internal router, the 3560 will be default gateway of all local machines
* As internal router, the 3560 also will decide if traffic should go to the router, PIX/ASA, or just local
* For all Internet traffic, the 3560 should point the traffic to the router. You can set this up by creating static route pointing to .7 to reach 0.0.0.0/0
* For all VPN connection to the remote site, the 3560 should point the traffic to the PIX/ASA. You can set this up by creating static route pointing to .5 to reach the remote site subnets.

The Router
* Setup proper NAT/PAT on the router to make sure all local machines can use the router Public IP address to go out to the Internet
* There should be static route pointing to the 3560 to reach all local machines
* There should be static route pointing to the PIX/ASA to reach the remote site via VPN

The PIX/ASA
* No NAT is necessary since the PIX/ASA is only as VPN Concentrator
* There should be static route pointing to the 3560 to reach all local machines
* There should be static route pointing to the router for Internet traffic

Sample Configurations

Router Configuration


PIX1/ASA1 Configuration


Catalyst 3560 Switch


Discussion:
»Design concept

feedback form

by aryoba See Profile
last modified: 2009-09-24 10:14:18



Saturday, 28-Nov 03:30:32 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.