[email protected] / * / PIX Interface

Similar Questions

• SMTP: MAIL FROM: [email protected] / * / blocks / expires

  First of all, I'm not a customer of Cisco, but a user of a network by a facility of PIX firewall. My username does not mean that I am affiliated with Cisco; It's just a way for me to remember it.

  I can't give you more details than the fact that there is a PIX protecting the network. I don't have its version number, unfortunately.

  In any case, here's the deal: I think that there is a bug in the way PIX handles SMTP sessions. Specifically, it seems to block/time out when I Specifies an address (MAIL FROM or RCPT TO) that contains a pipe character, ' | '.

  Some tests:

  (1) mail via localhost: no problem

  (2) mail via the internal host: no problem (no not a firewall)

  (3) mail via the external host: has a problem, but not systematically

  The interesting part is that the bug does not always occur. When I RCPT TO: [email protected]/ * / directly, everything stops and the connection times out. However, if I first RCPT TO: [email protected] / * / and subsequently, * in the same SMTP session *, RCPT TO: [email protected]/ * / he * is * working. Rather peculiar.

  Relevant sessions (with netcat):

  > [email protected] / * /: ~ $ nc firewalled.example.org smtp

  > 220 firewalled.example.org ESMTP Sendmail 8.12.10/8.11.4; Friday 20 August 2004 11:50:30 + 0200

  > HELO example.org

  > 250 firewalled.example.org Hello [213.196.33.33], the pleasure to meet you

  > MAIL FROM: [email protected] / * /

  > 250 2.1.0 [email protected] / * /... Sender OK

  > RCPT TO: [email protected]/ * /.

  My orders starts with a ">", responses from the server with ' > '. As you can see, nothing happens after the RCPT TO command with a ' | '.

  > [email protected] / * /: ~ $ nc firewalled.example.org smtp

  > 220 firewalled.example.org ESMTP Sendmail 8.12.10/8.11.4; Friday 20 August 2004 11:51:13 + 0200

  > HELO example.org

  > 250 firewalled.example.org Hello [213.196.33.33], the pleasure to meet you

  > MAIL FROM: [email protected] / * /

  > 250 2.1.0 [email protected] / * /... Sender OK

  > RCPT TO: [email protected] / * /

  > 250 2.1.5 [email protected] / * /... Recipient OK

  > DATA

  > 354 enter mail, end with "." on a line by itself

  > Subject: test 2 [email protected] / * /

  > .

  > 2.0.0 250 i7K9pD9i022438 Message accepted for delivery

  > MAIL FROM: [email protected] / * /

  > 250 2.1.0 [email protected] / * /... Sender OK

  > RCPT TO: [email protected]/ * /.

  > 250 2.1.5 [email protected]/ * /... Recipient OK

  > DATA

  > 354 enter mail, end with "." on a line by itself

  > Subject: [email protected]test *.

  > .

  > 2.0.0 250 i7K9pD9j022438 Message accepted for delivery

  > QUIT

  > 221 2.0.0 firewalled.example.org closing connection

  The first RCPT is to [email protected] / * / and works very well. Then, after the opinion of "message accepted", I begin a new mail and RCPT TO [email protected]/ * / * fact * work.

  Is this a bug in the software PIX itself? Network administrators say they have no special rules put in place and suggest that I just have to use an address without a ' | '. The problem is that requires change of address confirmation e-mails, but they never get through. In addition, the syntax of the address is valid.

  Anyone can shed light on this issue? You can reproduce it on your installation?

  Nice analysis... maybe you should work with the PIX a little more.

  In this case, however, no bug in the PIX (except that we through sometimes by your remark above). This behavior is specified. Of http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/config/fixup.htm#wp1103507

  "The MAIL and RCPT commands specify who is the sender and the recipient of the mail. The e-mail addresses are analysed for strange characters. The pipeline character (|) is removed (replaced by a white space) and "<" ‚"="">" are allowed if they are used to define an e-mail address ("' >" "must be preceded of '")<>

  There was some talk to the command pipelinig user definable, but at this time, no final word.

  Sorry for the trouble.

  Scott

• [Email protected] call blocking *.

  I see a lot of sip calls on my VCSe where [email protected] / * / ip ADDRESS or [email protected] / * / OR [email protected] / * /

  I was looking through the forums and found

  https://supportforums.Cisco.com/message/3401571#3401571

  Source Destination Protocol duration status Peer Type shares at start

  2013-11-15 12:26:27 sip:[email protected] / * / sip:[email protected] / * / <->SIP SIP 32 seconds 408 / Request Timeout view local VCS

  2013-11-15 12:26:23 sip:[email protected] / * / sip:[email protected] / * / <->SIP SIP 32 seconds 408 / Request Timeout view local VCS

  2013-11-15 12:26:20 sip:[email protected] / * / sip:[email protected] / * / <->SIP SIP 32 seconds 408 / Request Timeout view local VCS

  2013-11-15 12:26:16 sip:[email protected] / * / sip:[email protected] / * / <->SIP SIP 32 seconds 408 / Request Timeout view local VCS

  2013-11-15 12:26:13 sip:[email protected] / * / sip:[email protected] / * / <->SIP SIP 32 seconds 408 / Request Timeout view local VCS

  2013-11-15 12:06:56 sip:[email protected] / * / sip:[email protected] / * / <->SIP SIP 32 seconds 408 / Request Timeout view local VCS

  2013-11-15 12:00:53 sip:[email protected] / * / sip:[email protected] / * / <->SIP SIP 33 seconds 408 / Request Timeout view local VCS

  2013-11-15 11:05:26 sip:[email protected] / * / sip:[email protected] / * / <->SIP SIP 32 seconds 408 / Request Timeout view local VCS

  2013-11-15 10:14:14 sip:[email protected] / * / sip:[email protected] / * / <->SIP/SIP 32 seconds 408 / Request Timeout view local VCS

  2013-11-15 10:08:32 sip:[email protected] / * / sip:[email protected] / * / <->SIP SIP 32 seconds 408 / Request Timeout view local VCS

  It's my current CPL

  I now would change to:

  "http://www.Tandberg.net/Cpl-extensions" xmlns: xsi = "http://www.w3.org/2001/XMLSchema-instance" xsi: schemaLocation = "urn: ietf:params:xml:ns:cpl cpl.xsd" > "

  "" [email protected] / * / "destination =". * » >

  "" [email protected] / * / "destination =". * » >

  Is THIS CORRECT?

  It'll work, but you should have the two unathenticated and authenticated covered calls.

  Given that all your calls seems to come from @VCS_IP, then you can block all destinations by using * instead of specifying the address. Below is part of the CPL I use and it works for me.

  You can test if the CPL works or not using the VCS-E "tool to locate."

  In addition, you must disable SIP UDP on the VCS-E unless you really need, as these scanners use UDP to find potential targets.

  (Time only I had to re-activate if I have to make a call using the host name where the VCS-E did a search of A DNS record instead of using "normal" SRV records.)

  If you have ISDN deployed gateways, then you should also seriously consider changing the prefixes you use, i.e. Add # to the prefix to break the dial string. For example if your prefix is 99 and you want to call 9912345678, then you dial 99 #12345678 instead.

  Also see the deployment guide for more information about these issues - step 16, page 41 in particular

  http://www.Cisco.com/en/us/docs/Telepresence/infrastructure/VCs/config_guide/Cisco_VCS_Basic_Configuration_Cisco_VCS_Control_with_Cisco_VCS_Expressway_Deployment_Guide_X7-0.PDF

  /Jens

  Please note the answers and score the questions as "answered" as appropriate.

• Calls from [email protected] / * / ip addresses

  Hello world

  I get calls from [email protected] / * / IPS on my Highway VCS trying to dial different numbers. I activated a policy rule of local call to reject asterisk@.* to any destination. * but it does not work and I still get the call attempts.

  Someone has encountered this and knows how to stop these calls?

  Thank you

  Maciek

  Maciej,

  try to replace 'origin' with 'non-authenticated-origin' in your CPL, so that it reads as follows:

  CPL 'origin' field has a value of "is not far" If the message that the CPL is run for is not authenticated.

  You can find more information about the field of the 'non-authenticated-origin"in the VCS administration guide.

  Hope this helps,

  Andreas

• PIX interfaces

  Hello

  We are not supposed to assign an IP address for the PIX interfaces with a subnet mask 255.255.255.255.

  But why so and when a subnet mask 255.255.255.255 is used in general (even in a context of no - PIX)?

  (I noticed the subnet mask 255.255.255.255 attributed to the IP address of a host that connects to the Internet (a single dial-up connection).

  Could someone help me understand this concept of 32 mask?

  Thanks and greetings

  S. Lora

  The mask associated with an interface of PIX, or any other network equipment or hosts that same Win hosts (except dialup), determines the subnet range. To be able to communicate, you must have at least 2 hosts located on the same subnet or similar, otherwise the layer 2 Protocol will not be able to reach another host on that subnet.

  The case of dialup, is special, because Microsoft does not respect the principle of the subnet to breast DUN (network of remote access to Win driver). Microsoft, similarly, is not sure to IP address of the modem router provided by the access server, MS put the host IP address in the gateway field. In other words, a host of Win always send packets across the network PPP (remote connection) when they are intended for someone other than him. It is used when the host of numbering has only 1 interface, but what happens when this host is communicating with an access network remotely via a modem and a LAN at the same time. In the world of MS, this does not work. You need a special type of software to work around this poor implementation. Just to say that the network mask does not matter in the world MS dialup, you can find 255.255.255.255.

  Kind regards

  Ben

• Can the customer vpn to pix interface unprotected to a protected interface

  I have a pix multi-interface, the description of the interface is as follows:

  Outside-> 10MB to ISP

  Inside-> vlan main

  DMZ-> Web servers, etc...

  Lab1-> test application servers

  LAB2-> test application servers

  etc...

  Comments wireless-> free wireless (connected to the Cisco WAP)

  The open wireless only has access to the internet, not one of the reliable networks. It is an untrusted interface (security lvl 1). The external interface is security 0.

  I want to be able to allow vpn access from the wireless in networks of trust like vpn from outside (internet) is processed.

  I guess that the pix sees a vpn connection attempt to another of its interfaces.

  The client times out connecting since the wireless for the pix outside IP interface.

  The pix records simply this:

  January 20, 2009 13:38:23: % 7-710005-PIX: UDP request and eliminated from 192.168.20.5/1346 to GuestWireless:yy.yy.yy.yy/500

  the external interface IP = yy.yy.yy.yy

  the pix is also the dhcp server for wireless network connections.

  Is it still possible? If so, what Miss me?

  Thank you

  Dave

  To answer: -.

  The leg wireless of the PIX is the security level 1, and the external interface is the security level 0. That would not mean that vpn is launched from a higher to a lower security interface? Yes but the traffic is clear--asked to terminate a VPN connection to an interface that is locally attached to the PIX effectivly in the inside of the unit. Sure that PIX will refuse the connection he received on the external interface of the interface without comment thread.

  No it isn't the same thing, something like: -.

  crypto ISAKMP enable GuestWireless - this indicates the PIX to listen and accept connections VPN ISAKMP/issues of ANY device connected to this interface FOR the GuestWireless interface.

  HTH >

• Incoming direction on the Pix interfaces

  Access-group of statements always apply an ACL to an interface with the command "in the interface. The Pix docs say "this filter incoming packets to the given interface. I would like a clear definition of what's arrival. My understanding, according to the logic of the access lists that I have made a request, this incoming is-bound traffic in the interface of the Pix of the connected subnet. So for the following interfaces, traffic entering the following subnet provenance

  outdoor - traffic from the Internet

  inside - traffic from inside Lan

  DMZ - traffic coming from the DMZ

  I just wanted to check that, because it's contrasted with IOS router configs. My understanding is the following:

  Outside the s0 interface - incoming list applies to incoming traffic from the Internet

  Inside interface e0/0 - incoming list applies to incoming traffic traffic vs subnet towards inteface as in my example of Pix inside.

  If someone could verify this, point me to a link or correct my examples?

  Thank you

  RJ

  1. Yes, to filter incoming traffic in the interface

  2 traffic can originate from anywhere, that is to say of many jumps/subnets away or directly connected before it hits the interface, but it moves to the interface. Same logic on pix and router.

  3. Yes, to filter traffic leaving the interface

  4 Yes, traffic position away from the router to the connected subnet or a destination of many jumps far (PIX has no more outgoing ACL)

  Steve

• Cannot relay email to internal interface on IronPort by DNS, IP only

  Hello!

  I am fairly new with IronPort, but I need to is a relay on our interface internal on the Ironport and everything works fine until I Specifies the SMTP server with the IP address rather than to our dns entry that is mailrelay.doman.corp.

  I see the traffic going by our firewall well but it doesn't work. I don't see him not in the messagetracking function, but if I simulate it in the Trace feature that works too. It's an IronPort C370.

  So to summarize:

  Mailrelay.domain.Corp = 10.10.10.10

  10.10.10.10 telnet 25<-- this="">

  Telnet Mailrelay.domain.corp 25<-- this="" does="" not="">

  Any ideas how to fix?

  Thank you!

  Hi David,

  Your C370 is able to resolve the Mailrelay.domain.corp?

  You can configure your C370 to use your server to allow your C370's internal DNS resolve this, if you do not yet.

  It would help if you could share the output of the command:

  Telnet Mailrelay.domain.corp 25

  As you say the telnet IP address works, I guess the question is associated DNS.

  Kind regards

  Valter

• VCS Regex ([email protected] / * /)

  Hello, I noticed that when I try to call an IP address of a client Jabber video on the iPad, than if I just dial one IP address, it adds the SIP client Jabber domain name to the IP address and the call fails because it does not recognize this address format.  I know that I can call by putting an alias in front of the intellectual property and it work, but what a transformation regex would I need to integrate into our VCS for the call to work if users want to just put the single IP address?

  I want to take @and make it just .  How can I make this possible using the regex?

  Thanks, Patrick

  (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3)} (@domain.com)

  Then replace with \1, which is the first capturing group that must be the IPv4 address.

  You might want to put a? After the domain.com) bit so that becomes optional when it stops to send in the future.

  Sent by Cisco Support technique iPhone App

• What license for protection of Email?

  Hello

  We have a UTM50 from 2013. The first license period expires now.

  We use Email Protection but that you no longer use the Web Protection.

  I've already updated our Messaging Protection license which is valid until the 1.1.2017.

  Our Protection Web will expire in 3 days.

  The system sent me an email today:

  "Critical functions like filtering URL infested with malware, blocking websites that empty your productivity, scanning and cleaning downloads infected with the virus, as well as blocking SPAM e-mail are all dependent on these licenses"

  Is it possible that SPAM blocking depends ob Web protection not on the e-mail Protection.

  It would be a strange behavior.

  The information contained in the pages of support Netgear says something different: http://kb.netgear.com/app/answers/detail/a_id/20830

  What ist the right information?

  Can someone there explain.

  Thanks in advance.

  Michael

  After the expiration of the license for web protection last weekend the firewall blocks always spam.

  So I think it was a general message about the license expiring, but from my point of view, this kind of message is very annoying because you never know if there is a problem with filtering if you don't buy a license for the web anti-spam protection.

  This kind of email causes 'the fear '.

  If the junk e-mail filtering would have stopped we would receive hundreds of spam and which could cause chaos.

  I hope that netgear changes expired messages to be more precise.

  Thank you

  Michael

• 3 interfaces and routing PIX

  Hi all

  I have a PIX 515E configured with 3 interfaces, exterior, Interior and a Tunnel interface to my VPN clients. VPN clients not only access within the network, I have to move them to other networks through the external interface. As you cannot route the IPSEC packets from the same interface its entry, which is why I used a separate interface for VPN clients. Default gateway is set to the external interface. Now the problem is that when the vpn users try to connect to Internet, Tunnel interface is getting traffic but does not send back as default route traffic is defined on the external interface.

  Tunnel interface is 192.168.32.253 and if I connect from a pc with the ip address of 192.168.32.50, its works perfectly fine and also routing traffic to other networks through outside as PIX knows where to forward packets. Can someone please help me solve this problem of routing in PIX.

  the Interior is 192.168.33.254 security 0

  the outside is 192.168.34.254 security 100

  The tunnel is 192.168.32.253 security 90

  NAT (inside) - 0 110 access list

  access-list 110 permit ip 192.168.33.0 255.255.255.0 any

  Thanks in advance.

  KAZ

  Unless you know that networks, clients must connect to it may not be a solution, given that it looks like you need the default routes two, one for traffic encrypted clients and the other for traffic not encrypted Internet. You may be able to create a NAT pool in the router that provides Internet access to the Tunnel interface so that all incoming client traffic is coordinated in this router to an address from a pool. That would make all remote clients look like they came from a subnet, so you wouldn't need a default route on the interface of Tunnel in the PIX. You will probably need to do this router's Internet interface an interface 'ip nat inside' because I don't think that IOS supports dynamic NAT pools with 'ip nat outside source. It sounds backwards, but I think it would work. You'll probably also want to use an access list or with the pool route map, NAT to only apply to the traffic to the Tunnel from PIX interface (i.e. VPN traffic), as I'm assuming that the same router provides Internet connectivity for the interfaces from the outside and the Tunnel to the PIX.

  Good luck!

• Amount of the ACLs on an interface of the PIX

  Hi all

  I just wanted to know how much group-access entry (s) that you can attached to a 515ER PIX interface? I wonder if it's the same rule as the router, IE 1 ACL/interface/direction. En thank you your help.

  Hi Vincent,.

  You can apply to a single group-access on any pix interface... is not like in a router in a router, you can apply groups of incoming/outgoing access... On a pix you can apply only inbound access-groups...

  I hope this helps... all the best...

  REDA

• How to configure the PPPoE on PIX 501?

  Mailto: [email protected] / * /

  MSN: [email protected] / * /

  According to the below URL Cisco TAC:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00801055dd.shtml

  but I always failed. And my PIX 501 Configuration noted below:

  pixfirewall # write terminal

  Building configuration...

  : Saved

  :

  6.3 (1) version PIX

  interface ethernet0 10baset

  interface ethernet1 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  enable password xxxx

  passwd xxxx

  pixfirewall hostname

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  names of

  pager lines 24

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside pppoe setroute

  IP address inside 192.168.1.254 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Route inside 10.0.0.0 255.0.0.0 192.168.1.1 1

  Route inside 20.0.0.0 255.0.0.0 192.168.1.1 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  VPDN group pppoex request dialout pppoe

  Cisco localname VPDN group pppoex

  VPDN group ppp authentication pap pppoex

  VPDN username xxxx password *.

  Terminal width 80

  Cryptochecksum:xxxx

  : end

  [OK]

  See the pixfirewall version #.

  Cisco PIX Firewall Version 6.3 (1)

  Cisco PIX Device Manager Version 1.1 (2)

  Updated Thursday 19 March 03 11:49 by Manu

  pixfirewall until 58 mins 6 dry

  Material: PIX - 501, 16 MB RAM, 133 MHz Am5x86 CPU

  Flash E28F640J3 @ 0 x 3000000, 8 MB

  BIOS Flash E28F640J3 @ 0xfffd8000, 128KB

  0: ethernet0: the address is 000b.fd58.886b, irq 9

  1: ethernet1: the address is 000b.fd58.886c, irq 10

  Features licensed:

  Failover: disabled

  VPN - A: enabled

  VPN-3DES-AES: enabled

  Maximum Interfaces: 2

  Cut - through Proxy: enabled

  Guardians: enabled

  URL filtering: enabled

  Internal hosts: 50

  Throughput: unlimited

  you have all the debugging logs?

• MS CA VPN PIX (NO_PROPOSAL_CHOSEN)

  I use stand-alone MS Server CA to issue certificates, I have already installed the CEP add-on on Windows and there is connecvity between Pix and MS CA.

  -cert ca exit - sh

  CA

  Status: available

  Serial number of the certificate: 02c50c2f5832d9964ef6eb5f4ea988d6

  Use keys: Signature

  CN = jeff-pc

  OU = company

  O = Company

  L = SP

  ST = SP

  C = BR

  EA =<16> [email protected] / * /

  Validity date:

  start date: 09:43:12 BRST November 4, 2003

  ------------------

  I have already registered a VPN client with a certificate from this CA MS according to http://www.cisco.com/en/US/tech/tk583/tk372/technologies_tech_note09186a008009468a.shtml documentation, very usable...

  But whenever I try to establish a VPN between the VPN Client and VPN(rsa-sig) Pix, the IKE negotiation does not... with message (NOTIFY: NO_PROPOSAL_CHOSEN) on the Client VPN Log Viewer

  Vpn configuration-

  Crypto ipsec transform-set esp - esp-md5-hmac certset

  Crypto ipsec transform-set esp - esp-md5-hmac RIGHT

  Crypto-map dynamic dynmap 10 transform-set RIGHT

  map mymap 10-isakmp ipsec crypto dynamic dynmap

  client authentication card crypto LOCAL mymap

  mymap outside crypto map interface

  ISAKMP allows outside

  ISAKMP identity address

  ISAKMP policy 10 authentication rsa - sig

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 1 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  vpngroup address ippool2 pool vpncert

  vpngroup idle 1800 vpncert-time

  vpngroup password vpncert *.

  CA identity pc-jeff 10.10.10.230:/certsrv/mscep/mscep.dll

  CA set up pc-jeff 1 5 crloptional ra

  -------------------------------

  OBS: before the VPN works very well.

  I appreciate who can help me in this problem...

  Jefferson

  create a separate policy using Group 2, the client software cannot use Group1

  i.e.

  ISAKMP identity address

  You may need to change this on isakmp identity hostname '

  ISAKMP policy 10 authentication rsa - sig

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 1 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  ISAKMP policy 20 authentication rsa - sig

  encryption of ISAKMP policy 20

  ISAKMP policy 20 chopping sha

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  Try this first, there may be a problem using "isakmp identity address" rather than "isakmp identity hostname.

  I have information on my website about the configuration of Microsoft SCEP CA and Cisco routers that you might

  http://www.geocities.com/dgarnett2002/infoarch.html

• Internet access without split tunneling VPN PIX

  I have a PIX 515E with code 6.31. I installed a VPN to allow access to the internal network from the Internet using the Cisco VPN client. It does not work properly. We have some sellers who demand that we come from our Internet IP range to allow us access to their database on the Internet. This works very well for our internal users, but I will allow users VPN for this also.

  Is there a way to allow the user from the VPN client to use the Internet for business access to the internet instead of use the split tunneling to access the internet through their own connection? I would like users to vpn to be NAT would have réécrirait Internet and seeming come from our pool of Internet addresses. What I found references by using the split tunneling, but this won't work for me. Am I stuck getting a VPN concentrator to achieve?

  Thank you

  Josh

  [email protected] / * /.

  The PIX cannot route a package back on the same interface, he entered the, which includes a customer entering the interface external and routed VPN package back on the same interface.

  A router or a VPN concentrator would be able to do this, but not a PIX, sorry.