Network questions

Hey all,

My current home network goes through an all-in-one Netgear router/firewall/switch, but I'm changing to a dedicated Cisco setup (Not *really* nessecery, but it's good experiance for networking). I'm planning to have the folowing layout:

http://www.arbital24.com/Pics/NewNet.JPG

The reason that I want to use VLANs is because whilst my PC and etc should be able to connect to the internet, and the family PC should be able to connect to the internet, my pc should NOT be able to talk to the family PC. Yes, I know there are lots of other ways of doing this such as having them in different workgroups, utilizing all 4 ports on the PIX with/without switches, or with ACLs (with a router), I would rather avoid those choices of possible.

I don't have the Pix on me at the the moment, so I can't check, but I thought I would ask here before it arrives so I don't spend ages on it just to find out that it won't work:

Can I program the pix to allow the VLANS that should be talking to each other (1&2, 2&3) to talk to each other, in the same way as a "router on a stick" would? Or will I need a dedicated router on the switch? Since if I have to do that then it's extra expense.

I would assume that a second router is required, but the pix has 4 internal ports, and I do believe it can support some form of routing/access control between those, so I was wondering if it supported routing functions within one port? including subinterfaces?

Thanks!
Arby.

The PIX 501 only supports two networks, outside and inside. You would need to have the inside interface of the PIX setup as the gateway for all of the VLANs, and thus each would need to be able to reach it. What switch are you using, and more importantly does it do layer 3 routing?

I believe that you will still need to setup some ACLs no matter what if you don't want traffic to cross over into the other VLANs. The problem is that you need to provide a route so that it can find its way out to the internet. This would also allow it to find the other VLANs, and unless you create an ACL to block the traffic it would go between VLANs.

I believe you are going to need a router, set up subinterfaces and dot1q trunking. You can pick up a 2600 series for a couple hundred off ebay.

ErikD - it's a 3500 (3524 I think). No, it doesn't do routing, I was just wondering if the pix had routing capability, really.

cradivonyk - That's what I feared :/. I'm a bit short on cash, haha. Ah well.. Thanks!

If you had a 3550 or better you coulda done MLS and not needed a router. But since you don't, you will need a router. A 1721 would work just fine.

The PIX can do routing. The only issue is that on that particular model it can only have two directly connected networks as mentioned. It also doesn't support subinterfaces, so you will need a router do do what you want.

Ah ok, thanks ^_^