I am looking for some ideas on how I might utilize a second 5 internet ip address subnet I have available from my isp.
Currently I have the isp cable modem which has 5 ethernet ports on it. It is not (and probably can not) providing any firewall or filtering.
In to one of the ports I have a cisco pix 503 providing firewall, filtering, vpn. The pix has only two ports - WAN and LAN. The pix is currently set up using the 1st 5 ip address block and works fine. The pix has entries for static nat mapping for incoming traffic to servers on the LAN.
Off the LAN port of the pix I have a 3com Super Stack 3. This is the default gateway for all the machines on the lan. There is an entry in the stack to route traffic to the pix ip address and thus out to the internet.
Finally, I want to somehow set up some new internet servers on the 2nd 5 ip address block. It has a different gateway than the first block and a totally different number range and I have researched that there appears to be no way to add this block in to the pix. I would need to replace the pix with an ASA device with multiple physical connections.
I am looking for some brainstorming on alternative ideas:
- I was thinking one possibility would be to run a 2nd line from the cable modem in to a different firewall device - I have some other lower end units that would probably be adequate for a simple 5 ip address / 5 server nat mapping firewall setup. This would be a separate mini LAN from the super stack 3.
However, I need to be able to access these servers from inside the LAN also. I am not sure how I would connect these two networks together, possibly with static routing?
- I wonder if it's possible to go from the cable modem to a 2nd firewall device in to the super stack 3? I do not need any outgoing requests to go out this 2nd firewall, it is really only for incoming. That said, it would be nice if maybe there were a way to create entries in the super stack to route traffic for these 5 servers out the 2nd firewall.
Just looking for some concepts (besides replacing the pix) that you think would work. Thanks!