* You do BGP peering with another AS, hence requires a router or layer-3 switch to be the public edge equipment DSL, cable modem, T1, ISDN) or the router Internet-facing (WAN) interface is not Ethernet interface However there are some constraints that might prevent you to choose this option, such as:

This setup should be the best approach to tackle the problem. » Cisco Forum FAQ » Internet - PIX/ASA - Router - LAN Apply basic Firewall ACL to Internet-facing router interfaceĬheck out the following FAQ for sample configuration on setting a PIX Firewall in front of a router. Upgrade the router to run IOS image with FW featureģ. » Cisco Forum FAQ » NAT, PAT, Port Forward, Internet and Server Access: Introduction and Practicesįurther more, the following should be in place to protect your network in addition to nature PAT protection.ġ. For more info on NAT/PAT process, check out the following FAQ. When hackers on the Internet send unwelcomed traffic into Inside network, these traffic are unable to reach the intended Inside machines since there are multiple IP addresses represented by PAT and NAT session does not match such traffic, hence PAT dropped the traffic. PAT is designed to provide single Outside IP address for multiple Inside machines which connection is initiated from those Inside machines going out. When you have dynamic PAT in place for several internal machines to access the Internet, PAT by nature is already an advantage. * You need a good firewall to protect your network from Internet intruders.Ĭreate network-level protection in place to at least try to block unwanted incoming traffic from the Internet or from Untrusted network coming in.

* You have a router running basic IOS image without Firewall (FW) feature

Pix to asa migration tool 8.4