Virtual Private Networks, Second Edition

Chapter 9. The Cisco PIX Firewall

One of the most efficient and convenient options when creating a VPN is to install a network security device on your perimeter network to provide LAN-to-LAN tunneling, roaming, and authentication. Already, the major routing and network vendors have their own offerings in the field. In this chapter we will delve into the configuration of the Cisco PIX firewall product to give you an idea of how these devices are used and what benefits you can expect to gain from using them. We chose the Cisco PIX product because it was one of the first entrants into the market, it was backed by one of the largest and most trusted vendors (Cisco Systems), and we started work on this book at a time when integrated VPN products were few and far between and IPSec was not even fully formed by the IETF (the Internet Engineering Task Force).

The Cisco PIX Firewall

The PIX provides three basic VPN requirements: it separates the packet filtering functions from the main gateway router, it dynamically shares a pool of Internet addresses among many internal users, and several PIX units can be combined to create a VPN tunnel session between sites. In this chapter we will explore how the PIX firewall can be used in your network, and we will cover some basic installation and configuration techniques.

The PIX has two Ethernet ports: one for the internal (or private) network and one for the external (or public) network, which is normally the Internet. The PIX uses two Intel 10/100 Ethernet ...