a pix and zen 8 ips

[c00kie]

hi,

We have a zen broadband connection with 8 ips which we allocate to various servers like so:

x.x.x.2: network address
x.x.x.3: server 1: http/ftp
x.x.x.4: server 2: smtp/http
x.x.x.5: server 3: terminal server / server 4: http server
x.x.x.6: pix 501 for VPN access from outside
x.x.x.7: pix vpn users
x.x.x.8: router address
x.x.x.9: broadcast address

All ips are routed through a draytek adsl router which the pix is plugged into, and then all computers into that.

I would like to add wireless to the network OUTSIDE the pix (so users are effectively not on the same network as all servers etc). To do this I presume i could just plug the wireless device into the draytek, but then i dont have any spare ips to assign to it.

Is it necessary to assign vpn users a seperate external IP? does the wireless router require its own external ip?

thank you

 

[oddjob62]

To do this I presume i could just plug the wireless device into the draytek, but then i dont have any spare ips to assign to it.

Is it necessary to assign vpn users a seperate external IP?

does the wireless router require its own external ip?

- Yes that will work
- Been a while since i set up a PIX, but i have done a fair few and never had to assign a separate external IP for vpn users. Would have to see the config to see what that is actually doing.
- Yes the router will require an ip address.

Although IIRC (at least the old) Drayteks can be configured to route and NAT (on the "LAN TCP/IP and DHCP Setup" you can disable routing, but NAT is always on even if you don't use it), so you could create a NATed subnet in between the Draytek and the PIX, and give the wireless router an IP from there.

 

[c00kie]

Hi,

thank you for your comment.

firstly i got it wrong - the adsl comes into a zyxel prestige 660H-61 and i cant find anything in the documentation about creating a seperate subnet.

secondly, the pix uses two ips; one all clients behind it come from (if one goes to whatismyip.com for example it displays this) and the other is the ip for connecting to the vpn from outside the network. I would have thought these could be the same though?