1 PIX firewall, 2 routers, 2 switches. Please answer a couple questions about hack lab

Question

I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers

This is my plan for a topology but I am new at this so I need help. I am basing this off the illustration on the ethicalhacker.com "rant about hack labs" article here

I would like it if my attacker machine wasn't connected, but I can always make exceptions. Also, I can always switch up connections when I'm not doing certain scenarios. here are 2 topologies I based around that illustration:

Switch 1 -> router 1 -> switch 2 -> more servers

Switch 1 -> firewall 1 -> switch 2 -> exploitable web server

I want to simulate a "realistic" network layout, and also a "realistic" web setup.

I know I have something messed up, please guide me.

Feel free to yell and shout, as long as it helps me in some way to improve this.

ANY help will be greatly appreciated. Thanks so much.

edit: My god...the whole cable set up is ridiculous! I need all sorts of console cables and also adapters to plug it in my computer. Mmm more money to spend.

Answer 1

I find the setup illustrated in EH to be quite complex for home use or if you dont want too much work. I would recommend setting up a "cooporate network" with one entrance or node to the "internet" (which is your point of entrance when pentesting)

I would do it like this:

Cloud -> Router -> Firewall -> Switch1 (Office computers/clients) and switch2 (Which is DMZ for virtual servers)

If you need some guidance in setting it up and finding the various CLI's to be confusing with the different connection methods, you might want to practice a bit in Cisco's Packet Tracer, where you can use the ios images which almost mirrors the real world ios images for the hardware.

Answer 2

Depending on your model of PIX, and what version of the OS is loaded on it, you actually have a lot of options. If you have something with PIXOSv7 or higher (that is a 515 or better with at least 256MB of RAM) you can run your PIX in either routed or transparent mode. So what you could do is:

switch1 -> router -> firewall(transparent) -> switch2

And this would simulate a fairly common corporate network where switch2 would represent the machine room network, the router would be your network core, and switch1 would be an office area.

Similarly, you could rearrange things a little thusly

switch1 -> router -> switch2 -> firewall(transparent)

to represent a network edge where switch1 would be external space, switch2 a DMZ and use the inside interface of the PIX to be the protected network.

If your is 515 or better, and has the add-on interface module (that takes you from 2 to 6 ports) then you can start getting really fancy with things like multiple contexts. That is, up to 3 virtual firewalls in your single device.