Re: Pix as router?
- From: Bod43@xxxxxxxxxxxxx
- Date: Tue, 8 Apr 2008 02:49:10 -0700 (PDT)
On 8 Apr, 03:29, rober...@xxxxxxxxxxxx (Walter Roberson) wrote:
In article <76699e04-417d-467d-95b0-34fc83263...@xxxxxxxxxxxxxxxxxxxxxxxxxxx>,
<Bo...@xxxxxxxxxxxxx> wrote:
I have a pix (well several) and just want a router (just one)
for a private link. Pix is plenty man enough for the job and
I don't need GRE or any dynamic routing.
Am I likely to regret it?
If I set inside and outside to secutrity level 0
and/or put permit ip any any on the interfaces
am I likely to run into any unexpected (for someone who
does not really understand the Pix but does understand
routers) problems?
No NAT no nothing - just a basic IP router.
If you are running PIX 4, 5, or 6, then you cannot do that.
For one thing, in those versions, interfaces with the same
security level cannot communicate with each other. For another
thing, even when it is not doing NAT, PIX 4, 5, 6 *always* do
some checks such as that a SYN ACK was in response to an outgoing
SYN (there is a theory that using nat 0 access-list disables these
checks, but the documentation is less than clear on this.)
If you use 'static' commands then use the 'norandomseq' option.
PIX 4, 5, 6 are designed to always get in the way of traffic: they are
-designed- not to *forward* packets, but to instead -receive- packets
and build new outgoing packets. The theory is that if there was a
packet -forwarding- path, then some external hackery might potentially
fool the PIX into forwarding arbitrary hostile or misshaped packets --
so instead, packets are received and output packets are only built and
emitted in response to specific rules in the configuration. Tain't
designed to be able to "just pass along" whatever weirdness might
be in a packet, the way a router is.
The packet flow model was changed in PIX 7, so like the other poster
indicated, there are things you can do in PIX 7 point whatever;
this things Just Won't Work in PIX 4, 5, or 6.
Sorry should have said, 6.3.4 - no idea what I was not thinking.
I feared as much - which was why I asked.
Thing is I am having trouble understanding, and therefore
believing the answer. It is today a prefectly good "router"
of IP packets over IPSEC VPN which has been configured on
a private link. It cannot drive the VPN at line rate
or anywhere near and the obvious solution is to turn
it into a "router". I was clearly mistaken regarding the
security level statement however surely with symmetric
routing i.e. all packets in both directions flow through
the pix, and with permit ip any any on the input to the
low security interface it will indeed behave as a router
for all practical communications purposes?
There will only be one path so it can be guaranteed that packets will
always be symmetrically routed.
Anyway, maybe I will content myself with null encryption.
Thanks.
.
- Follow-Ups:
- Re: Pix as router?
- From: Gary
- Re: Pix as router?
- References:
- Pix as router?
- From: Bod43
- Re: Pix as router?
- From: Walter Roberson
- Pix as router?
- Prev by Date: Re: Switch or Router for routing betwean VLANS with 500 computers
- Next by Date: Re: HW & SW VPN client -- need routing workaround
- Previous by thread: Re: Pix as router?
- Next by thread: Re: Pix as router?
- Index(es):
Relevant Pages
|
|
