Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have pix 501 cisco firewall with internal ip I have connected d-link router (dir-655) to pix 501. The d-link router has internal ip

The picture would like something like that:

|pix 501| has ip
|DIR-655| has ip

1. |cable modem|----|pix 501|-------|DIR-655|-----PC
2. PC--------|pix 501|---------|DIR-655|
        |cable modem|

When I'm on the wireless network (dir-655) with assigned ip of 192.168.0.x I can cross the subnet and connect to my firewall (pic. 1)

The problem is that if I'm on the 192.168.10.x network I can't connect to anything over at 192.168.0.x network. (pic.2)

I've tried entering a static route like this:

`route inside 1`

I also tried assigning static ip to wan interface on DIR-655 to and then tried this:

route inside 1

But still, can't connect to or anything on that subnet.

Is there a way to setup a static route? Would adding a separate router between PIX 501 and DIR-655 help?

I would think that static route like this should take care of it, but it doesn't.

This is my route config and nat:

(config)# sh route
outside (outside_IP) 1 DHCP static
outside (outside_IP) (outside_IP) 1 CONNECT static
inside 1 OTHER static
inside 1 CONNECT static

or (route inside 1)

(config)# sh nat
nat (inside) 1 0 0
nat (inside) 1 0 0
nat (inside) 1 0 0

I ended up turning DIR-655 into an Access Point (turning off DHCP and pluging cable from PIX lan interface into one of the LAN interfaces on DIR-655, and leaving WAN port empty), that works as far as DIR-655 being on the same subnet now, and I can access every machine. However the question is, why can't I simply route between those two? would router between these two help? One of the reasons is, that the PIX 501 has only 10 licences, so now I'm using almost all of them. (I have few computers, iphones, ps3, print server, etc.)

I would really appreciate some help! Thanks.

share|improve this question
up vote 0 down vote accepted

adding a router isn't going to help. I would look at configuring zones/trust values on your pix. working in one direction and not the other tells me one is more trusted than the other, so ESTABLISHED return traffic gets there. i don't see it as a routing problem, but a trust problem. on newer cisco ASA's they pass traffic across all ports until you define groups, but on the older 501's I seem to remember fail closed instead of fail open.

an alternate possibility is some goofiness with the integrated switch forwarding to wifi - but this would be a firmware but - unlikely.

edit: nameif is the command you should be looking at I think:

I would look at putting the different IP ranges in different zones with equal security values.

share|improve this answer
I will try to enable some debugging on PIX 501 and see if that tell me anything. I don't if there's anything to setup as far as trust, perhaps I can play with access-list(s). – ra170 Nov 22 '10 at 19:25
nameif is the command you should be looking at I think:… – hbdgaf Nov 22 '10 at 19:36
My outside and inside security levels are 0 and 100. ethernet0 outside security0 nameif ethernet1 inside security100 – ra170 Nov 24 '10 at 7:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.