Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 4 Feb 2005 10:16:31 +0300
From:      "Nickolay Kritsky" <Nickolay.Kritsky@astra-sw.com>
To:        "Brett Glass" <brett@lariat.org>, <net@freebsd.org>
Subject:   RE: Does the Cisco PIX have an equivalent of the IPFW "fwd" action?
Message-ID:  <D86BF562467D944EB435513F725B236A07C14E@exchange.stardevelopers4msi.com>

Next in thread | Raw E-Mail | Index | Archive | Help
Brett, I do not think that PIX has an equivalent of ipfw 'fwd' command. =
The fastest way, IMHO would be just set up your transparent web proxy as =
a default gateway for PIX. You can also try policy routing as described =
in this Usenet article: =
http://groups-beta.google.com/group/comp.dcom.sys.cisco/browse_frm/thread=
/e131e32e97e4566/ee37814ac6c6c658?q=3Dpix+transparent&_done=3D%2Fgroups%3=
Fq%3Dpix+transparent%26hl%3Den%26lr%3D%26sa%3DN%26tab%3Dwg%26&_doneTitle=3D=
Back+to+Search&&d#ee37814ac6c6c658

But I wouldn't try this if I were you. PIX is not IOS, and AFAIK it was =
not designed for complex network solutions. Firewall - yes. Filtering, =
security features, advanced VPN support - yes. But not routing tricks.
Hope that helps

Nick

-----Original Message-----
From: Brett Glass [mailto:brett@lariat.org]
Sent: Friday, February 04, 2005 2:34 AM
To: net@freebsd.org
Subject: Does the Cisco PIX have an equivalent of the IPFW "fwd" action?


I'm setting up a FreeBSD transparent Web proxy for a client which has an =
old=20
(vintage 1998) Cisco PIX firewall router. I know how to make the proxy =
accept=20
packets forwarded to it (even though the destination IP addresses of =
those
packets will not be that of the proxy machine itself) and do transparent =
caching.=20
However, to complete the puzzle, I need to make the client's PIX =
firewall forward=20
outbound packets destined for port 80 (regardless of IP address) to the =
proxy. I=20
can't seen to find the magic incantation in Cisco's online docs. Does =
anyone here=20
know the Cisco equivalent of the IPFW "fwd" action, (which changes the =
"next hop"=20
MAC address of a packet if it meets the criteria specified in a rule) =
and how to=20
write a rule for the PIX to forward the packets? Help would be much =
appreciated.

--Brett Glass

_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"



Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?D86BF562467D944EB435513F725B236A07C14E>