Multiple IP address on PIX 515 - 1 for VPN traffic and 1 for interenet 1

[slyride]

Hello,
I am seeking to configure my PIX 515 so that vpn users can connect to a different public IP address than the public IP address that is used for internet traffic. Currently I have 2 FE interfaces, one is the outside and the other the inside. I suspect that I will need one more on the inside so that I can have internet traffic routed through one and VPN traffic through the other. So how far off am I? Let me add that I currently have the VPN set up to connect to the same IP that is the public IP for outbound internet, there is no incoming except the VPN traffic.

 

[dopehead]

Not really understanding completely here, you don't need another public address to terminate vpns on, actually you can't the address on the outside interface is the one you terminate vpn sessions on both client and lan-to-lan sessions.

The pix is perfectly equipped to handle both internet traffic and vpn on the same ip address.

Jan


Network Systems Engineer
CCNA/CQS/CCSP/Infosec

 

[slyride]

Hello Jan,
Thanks for responding. The concern I was trying to address is that if someone browses to a questonable site and that site takes down the ip address that the connection came from, would that make the vpn connections less secure as they connect to that same IP address? Or am I underestimating the PIX and that scenario should not pose a problem?
Thanks
Leon

 

[dopehead]

Hmm, if by take down you mean DDOS attack then no, cause your inet connection will be flooded, and it does not matter what address is attacked your bandwidth will be consumed by the attack anyways.

Jan


Network Systems Engineer
CCNA/CQS/CCSP/Infosec

 

[slyride]

Thanks again, excellent point, what about port scans and/or sniffing?

 

[dopehead]

Well, you can't really flood a port as such, since the packet for ipsec tunnels has to be a valid SPI and as such belong to an authenticated tunnel to be processed further. But if you are concerned, just use another address in your "global (outside) 1 x.x.x.x" statement than the one your pix's outside interface has.

Jan


Network Systems Engineer
CCNA/CQS/CCSP/Infosec