1. © 2001, Cisco Systems, Inc. CSPFA 2.0—6-1 Chapter 6 Configuring Multiple Interfaces

2. © 2001, Cisco Systems, Inc. www.cisco.com CSPFA 2.0—6-2 Objectives Upon completion of this chapter, you will be able to perform the following tasks: Configure three interfaces on the PIX Firewall. Configure four interfaces on the PIX Firewall.

3. © 2001, Cisco Systems, Inc. CSPFA 2.0—6-3 Configuring Additional Interfaces

4. © 2001, Cisco Systems, Inc. www.cisco.com CSPFA 2.0—6-4 Additional Interface Support Supports up to six additional interfaces Increases the security of publicly available services Easily interconnects multiple extranet or partner networks Easily configured with standard PIX Firewall commands e0 e1 e3 e2 e4 e5 e6 e7

5. © 2001, Cisco Systems, Inc. www.cisco.com CSPFA 2.0—6-5 Access Through the PIX Firewall PIX Firewall e0 outside.2 security level 0 Internet e1 inside.1 security level 100 nat and global static and conduit (or static and access list)

6. © 2001, Cisco Systems, Inc. www.cisco.com CSPFA 2.0—6-6 Configure Three Interfaces pixfirewall(config)# nameif ethernet0 outside sec0 pixfirewall(config)# nameif ethernet1 inside sec100 pixfirewall(config)# nameif ethernet2 dmz sec50 pixfirewall(config)# ip address outside 192.168.0.2 255.255.255.0 pixfirewall(config)# ip address inside 10.0.0.1 255.255.255.0 pixfirewall(config)# ip address dmz 172.16.0.1 255.255.255.0 pixfirewall(config)# nat (inside) 1 10.0.0.0 255.255.255.0 pixfirewall(config)# global (outside) 1 192.168.0.10-192.168.0.254 netmask 255.255.255.0 pixfirewall(config)# global (dmz) 1 172.16.0.10- 172.16.0.254 netmask 255.255.255.0 pixfirewall(config)# static (dmz,outside) 192.168.0.11 172.16.0.2 pixfirewall(config)# conduit permit tcp host 192.168.0.11 eq http any pixfirewall(config)# nameif ethernet0 outside sec0 pixfirewall(config)# nameif ethernet1 inside sec100 pixfirewall(config)# nameif ethernet2 dmz sec50 pixfirewall(config)# ip address outside 192.168.0.2 255.255.255.0 pixfirewall(config)# ip address inside 10.0.0.1 255.255.255.0 pixfirewall(config)# ip address dmz 172.16.0.1 255.255.255.0 pixfirewall(config)# nat (inside) 1 10.0.0.0 255.255.255.0 pixfirewall(config)# global (outside) 1 192.168.0.10-192.168.0.254 netmask 255.255.255.0 pixfirewall(config)# global (dmz) 1 172.16.0.10- 172.16.0.254 netmask 255.255.255.0 pixfirewall(config)# static (dmz,outside) 192.168.0.11 172.16.0.2 pixfirewall(config)# conduit permit tcp host 192.168.0.11 eq http any e0 e2 e1 Bastion host.2.1.2 172.16.0.0/24 10.0.0.0/24 192.168.0.0/24 Internet

7. © 2001, Cisco Systems, Inc. www.cisco.com CSPFA 2.0—6-7 Configure Four Interfaces pixfirewall(config)# nameif ethernet0 outside sec0 pixfirewall(config)# nameif ethernet1 inside sec100 pixfirewall(config)# nameif ethernet2 dmz sec50 pixfirewall(config)# nameif ethernet3 partnernet sec40 pixfirewall(config)# ip address outside 192.168.0.2 255.255.255.0 pixfirewall(config)# ip address inside 10.0.0.1 255.255.255.0 pixfirewall(config)# ip address dmz 172.16.0.1 255.255.255.0 pixfirewall(config)# ip address partnernet 172.26.26.1 255.255.255.0 pixfirewall(config)# nat (inside) 1 10.0.0.0 255.255.255.0 pixfirewall(config)# global (outside) 1 192.168.0.10- 192.168.0.254 netmask 255.255.255.0 pixfirewall(config)# global (dmz) 1 172.16.0.10- 172.16.0.254 netmask 255.255.255.0 pixfirewall(config)# static (dmz,outside) 192.168.0.11 172.16.0.2 pixfirewall(config)# conduit permit tcp host 192.168.0.11 eq http any pixfirewall(config)# static (dmz,partnernet) 172.26.26.11 172.16.0.2 pixfirewall(config)# conduit permit tcp host 172.26.26.11 eq http any pixfirewall(config)# nameif ethernet0 outside sec0 pixfirewall(config)# nameif ethernet1 inside sec100 pixfirewall(config)# nameif ethernet2 dmz sec50 pixfirewall(config)# nameif ethernet3 partnernet sec40 pixfirewall(config)# ip address outside 192.168.0.2 255.255.255.0 pixfirewall(config)# ip address inside 10.0.0.1 255.255.255.0 pixfirewall(config)# ip address dmz 172.16.0.1 255.255.255.0 pixfirewall(config)# ip address partnernet 172.26.26.1 255.255.255.0 pixfirewall(config)# nat (inside) 1 10.0.0.0 255.255.255.0 pixfirewall(config)# global (outside) 1 192.168.0.10- 192.168.0.254 netmask 255.255.255.0 pixfirewall(config)# global (dmz) 1 172.16.0.10- 172.16.0.254 netmask 255.255.255.0 pixfirewall(config)# static (dmz,outside) 192.168.0.11 172.16.0.2 pixfirewall(config)# conduit permit tcp host 192.168.0.11 eq http any pixfirewall(config)# static (dmz,partnernet) 172.26.26.11 172.16.0.2 pixfirewall(config)# conduit permit tcp host 172.26.26.11 eq http any Partnernet e0 e2 e1 Bastion host DMZ.2.1.2 172.16.0.0/24 10.0.0.0/24 192.168.0.0/24 e3 172.26.26.0/24.1 Internet

8. © 2001, Cisco Systems, Inc. CSPFA 2.0—6-8 Summary

9. © 2001, Cisco Systems, Inc. www.cisco.com CSPFA 2.0—6-9 Summary The PIX Firewall can be configured with up to six additional interfaces. Configuring multiple interfaces requires more attention to detail but can be done with standard PIX Firewall commands. To enable users on a higher security level interface to access hosts on a lower security interface, use the nat and global commands. To enable users on a lower security level interface to access hosts on a higher security interface, use the static and conduit commands.

10. © 2001, Cisco Systems, Inc. CSPFA 2.0—6-10 Lab Configuring Multiple Interfaces

11. © 2001, Cisco Systems, Inc. www.cisco.com CSPFA 2.0—6-11 Inside host web and FTP server Backbone server web, FTP, and TFTP server Lab Visual Objective Pod perimeter router PIX Firewall 192.168.P.0/24.1 e1 inside.1.3 10.0.P.0 /24 e0 outside.2 e2 dmz.1 Bastion host web and FTP server 172.26.26.50.2 172.16.P.0/24 Internet