I've never had to deal with this particular configuration before, so I want to make sure it's going to work roughly as I expect before buying the router and fighting with the Cisco gear.
- We already have a PIX 515E up and running fine.
- We have two ISPs (ISP-1, ISP-2) of identical nature. Consider them unremarkable DSL lines that each provide a small set of static IPs off an ethernet connection. Both of these ISPs are active at once (this is not a failover configuration, it's bandwidth and quality of service management to compensate for local difficulties).
- We want to route traffic based on a combination of rules that our existing PIX (515E) can't fully deal with on its own, such as:
- Certain internal boxes need to get routed out ISP-1, others out ISP-2.
- Inbound connections need to go back out the proper ISP.
- We have two site-to-site VPNs (and possibly more to come) terminating on the PIX. We want that to continue.
- Current internal network structure needs to remain largely intact (grabbing an ASA 5505 and moving boxes over is not a good option).
- BGP is nowhere in this mix, so don't worry about it.
My current plan is:
- Purchase either a Cisco 2901 router + HWIC, OR a 2911 router, and put it between the PIX and the ISPs. (Assume included IP Base software)
- Basically
nat 0most everything on the PIX. - Move the NAT rules to the router.
- Implement the various source/destination routing/NAT rules mentioned above.
- Static NAT an IP on one of the ISPs to the PIX for the VPN tunnels.
Is this likely to work as expected? If not, is there a reasonably close alternative? (Or a plainly superior solution that doesn't involve either much more expense than a 2911, or a lot of hackery on the internal network?)
