© 2001, Cisco Systems, Inc. CSPFA 2.0—6-1 Chapter 6 Configuring Multiple Interfaces

© 2001, Cisco Systems, Inc. CSPFA 2.0—6-2 Objectives Upon completion of this chapter, you will be able to perform the following tasks: Configure three interfaces on the PIX Firewall. Configure four interfaces on the PIX Firewall.

© 2001, Cisco Systems, Inc. CSPFA 2.0—6-3 Configuring Additional Interfaces

© 2001, Cisco Systems, Inc. CSPFA 2.0—6-4 Additional Interface Support Supports up to six additional interfaces Increases the security of publicly available services Easily interconnects multiple extranet or partner networks Easily configured with standard PIX Firewall commands e0 e1 e3 e2 e4 e5 e6 e7

© 2001, Cisco Systems, Inc. CSPFA 2.0—6-5 Access Through the PIX Firewall PIX Firewall e0 outside.2 security level 0 Internet e1 inside.1 security level 100 nat and global static and conduit (or static and access list)

© 2001, Cisco Systems, Inc. CSPFA 2.0—6-6 Configure Three Interfaces pixfirewall(config)# nameif ethernet0 outside sec0 pixfirewall(config)# nameif ethernet1 inside sec100 pixfirewall(config)# nameif ethernet2 dmz sec50 pixfirewall(config)# ip address outside pixfirewall(config)# ip address inside pixfirewall(config)# ip address dmz pixfirewall(config)# nat (inside) pixfirewall(config)# global (outside) netmask pixfirewall(config)# global (dmz) netmask pixfirewall(config)# static (dmz,outside) pixfirewall(config)# conduit permit tcp host eq http any pixfirewall(config)# nameif ethernet0 outside sec0 pixfirewall(config)# nameif ethernet1 inside sec100 pixfirewall(config)# nameif ethernet2 dmz sec50 pixfirewall(config)# ip address outside pixfirewall(config)# ip address inside pixfirewall(config)# ip address dmz pixfirewall(config)# nat (inside) pixfirewall(config)# global (outside) netmask pixfirewall(config)# global (dmz) netmask pixfirewall(config)# static (dmz,outside) pixfirewall(config)# conduit permit tcp host eq http any e0 e2 e1 Bastion host / / /24 Internet

© 2001, Cisco Systems, Inc. CSPFA 2.0—6-7 Configure Four Interfaces pixfirewall(config)# nameif ethernet0 outside sec0 pixfirewall(config)# nameif ethernet1 inside sec100 pixfirewall(config)# nameif ethernet2 dmz sec50 pixfirewall(config)# nameif ethernet3 partnernet sec40 pixfirewall(config)# ip address outside pixfirewall(config)# ip address inside pixfirewall(config)# ip address dmz pixfirewall(config)# ip address partnernet pixfirewall(config)# nat (inside) pixfirewall(config)# global (outside) netmask pixfirewall(config)# global (dmz) netmask pixfirewall(config)# static (dmz,outside) pixfirewall(config)# conduit permit tcp host eq http any pixfirewall(config)# static (dmz,partnernet) pixfirewall(config)# conduit permit tcp host eq http any pixfirewall(config)# nameif ethernet0 outside sec0 pixfirewall(config)# nameif ethernet1 inside sec100 pixfirewall(config)# nameif ethernet2 dmz sec50 pixfirewall(config)# nameif ethernet3 partnernet sec40 pixfirewall(config)# ip address outside pixfirewall(config)# ip address inside pixfirewall(config)# ip address dmz pixfirewall(config)# ip address partnernet pixfirewall(config)# nat (inside) pixfirewall(config)# global (outside) netmask pixfirewall(config)# global (dmz) netmask pixfirewall(config)# static (dmz,outside) pixfirewall(config)# conduit permit tcp host eq http any pixfirewall(config)# static (dmz,partnernet) pixfirewall(config)# conduit permit tcp host eq http any Partnernet e0 e2 e1 Bastion host DMZ / / /24 e /24.1 Internet

© 2001, Cisco Systems, Inc. CSPFA 2.0—6-8 Summary

© 2001, Cisco Systems, Inc. CSPFA 2.0—6-9 Summary The PIX Firewall can be configured with up to six additional interfaces. Configuring multiple interfaces requires more attention to detail but can be done with standard PIX Firewall commands. To enable users on a higher security level interface to access hosts on a lower security interface, use the nat and global commands. To enable users on a lower security level interface to access hosts on a higher security interface, use the static and conduit commands.

© 2001, Cisco Systems, Inc. CSPFA 2.0—6-10 Lab Configuring Multiple Interfaces

© 2001, Cisco Systems, Inc. CSPFA 2.0—6-11 Inside host web and FTP server Backbone server web, FTP, and TFTP server Lab Visual Objective Pod perimeter router PIX Firewall P.0/24.1 e1 inside P.0 /24 e0 outside.2 e2 dmz.1 Bastion host web and FTP server P.0/24 Internet