Kindly Advise...

[mbvales]

---

Naa ko existing VSAT connection and ISA 2000 Firewall

VSAT ----- ISA2000 ----- Switch (mao ni existing setup nko karon)

Now nakapalit ko Pix506e firewall og naa koy spare na Cisco 805 router sa ako leased line before; unsa ang gwapo na setup

VSAT --- PIX506e --- ISA2000 --- Switch
or
VSAT --- PIX506e --- Cisco805 Router --- Switch (tpos connect na lng nko ang ISA sa switch unya configure as proxy na lng)
or
VSAT --- PIX506e --- Switch

[Tamblot]

I would go for option 2 if i need routing in the internal network and i dont have layer 3 switch. The ISA can still take the proxy role for added security which the PIX cant provide.

Otherwise i go for option 1. With this, i can create a DMZ between the the PIX and ISA where i can deploy public servers or use it as a multipurpose test /quarantine zone.

[mbvales]

Many thanks bro tamblot!

[pedro_iho]

sakto c Sir tamblot bossing, unsa imong VSAT? Dream?

[mbvales]

C-Band BUC
Antenna Dish 2.4m
VIASAT

[ridney]

mbvales, tamblot is right. i just want to make a clarification to option2, does the Cisco 805 have 2 ethernet interfaces? you need this to connect to the switch and the pix fw. and how many ethernet interfaces does the pix have?

[mbvales]

mbvales, tamblot is right. i just want to make a clarification to option2, does the Cisco 805 have 2 ethernet interfaces? you need this to connect to the switch and the pix fw. and how many ethernet interfaces does the pix have?

Thanks for you query.. Im a little bit confused also coz' the VSAT already using RCST router but anyway to answer it Cisco805 router has only 1 ethernet interface, 1 Console & 1 serial and 2 ethernet for PIX506e.

Current setup= VSAT --- RCST --- ISA --- Switch-- LAN (I used ISA to make routing for my internal network)

Now if we put PIX it will become like this

VSAT --- RCST --- PIX --- Switch --- LAN (I will use NAT from PIX for my internal network) No need Cisco805 router here.
|
--- ISA (Proxy/Cache/WebFilter Server only no more firewall)

Correct me if im wrong i dnt know yet if this is a correct configuration.

2nd thing if I put my WIFI on a separate switch to protect my admin LAN using different subnet would it be possible on this configuration or what is the better setup? Thanks in advance

Note: I dont want to setup VLAN on my existing switch

[ridney]

your set-up is correct IMO however, if you implement routing between vlans then you need additional layer 3 device. the pix cannot trunk an ethernet interface AFAIK, on an ASA5500 i believe this would be possible.

[mbvales]

Thanks...I decided to make my setup like this

VSAT -- RCST -- PIX -- ISA -- Switch
|
__WiFi Switch

Note: I just added 1 ethernet to my ISA for Wifi

[Tamblot]

Is your wifi network for internal use? is there a need to control their traffic going to the internet? Does RCST provide the NAT? How about this?

VSAT -- RCST -- SWITCH -- PIX -- ISA -- SWITCH
| -- WIFI Network

If you want to control internet access for your wifi then my suggestion wont work.