I bought a bunch of cisco equipment for a project and I got 1 PIX firewall 2 switches and 2 routers

This is my plan for a topology but I am new at this so I need help. I am basing this off the illustration on the ethicalhacker.com "rant about hack labs" article here

I would like it if my attacker machine wasn't connected, but I can always make exceptions. Also, I can always switch up connections when I'm not doing certain scenarios. here are 2 topologies I based around that illustration:

Switch 1 -> router 1 -> switch 2 -> more servers

Switch 1 -> firewall 1 -> switch 2 -> exploitable web server

I want to simulate a "realistic" network layout, and also a "realistic" web setup.

I know I have something messed up, please guide me.

Feel free to yell and shout, as long as it helps me in some way to improve this.

ANY help will be greatly appreciated. Thanks so much.

edit: My god...the whole cable set up is ridiculous! I need all sorts of console cables and also adapters to plug it in my computer. Mmm more money to spend.

  • A single console cable and adapter should work, you just plug into the device you want to configure.
    – schroeder
    Commented Apr 13, 2012 at 18:25
  • I chose an answer but I was searching around certificationkits.com and found some common topologies if anyone ever finds this article in the future and needs guidance. here you go
    – Hal Jordan
    Commented Apr 13, 2012 at 22:46

2 Answers 2


I find the setup illustrated in EH to be quite complex for home use or if you dont want too much work. I would recommend setting up a "cooporate network" with one entrance or node to the "internet" (which is your point of entrance when pentesting)

I would do it like this:

Cloud -> Router -> Firewall -> Switch1 (Office computers/clients) and switch2 (Which is DMZ for virtual servers)

If you need some guidance in setting it up and finding the various CLI's to be confusing with the different connection methods, you might want to practice a bit in Cisco's Packet Tracer, where you can use the ios images which almost mirrors the real world ios images for the hardware.

  • Thanks! This is pretty much what I'm going to do as a topology.
    – Hal Jordan
    Commented Apr 13, 2012 at 22:47

Depending on your model of PIX, and what version of the OS is loaded on it, you actually have a lot of options. If you have something with PIXOSv7 or higher (that is a 515 or better with at least 256MB of RAM) you can run your PIX in either routed or transparent mode. So what you could do is:

switch1 -> router -> firewall(transparent) -> switch2

And this would simulate a fairly common corporate network where switch2 would represent the machine room network, the router would be your network core, and switch1 would be an office area.

Similarly, you could rearrange things a little thusly

switch1 -> router -> switch2 -> firewall(transparent)

to represent a network edge where switch1 would be external space, switch2 a DMZ and use the inside interface of the PIX to be the protected network.

If your is 515 or better, and has the add-on interface module (that takes you from 2 to 6 ports) then you can start getting really fancy with things like multiple contexts. That is, up to 3 virtual firewalls in your single device.

  • Interesting... I have the pix-515e with two ethernet ports(along with)..not sure about the RAm, it only has one ram card so it's prob not a whole bunch. I think I might need to google some manuals to get this set up. I'm looking at an online manual for it and it says a new package would come with a failover serial cable and a PC terminal adapter...do I need these??
    – Hal Jordan
    Commented Apr 13, 2012 at 3:18
  • @HalJordan: So you don't have the extra interface card, meh. As I recall those things take PC100 ram, so you might be able to find something off-the-shelf, or in-the-drawer. The failover cable is only useful if you have multiples, but the console cable is important. It will work for all Cisco kit, though, so should be easy to find.
    – Scott Pack
    Commented Apr 13, 2012 at 11:44
  • Awesome answers, thanks for the help! Can't wait to get my new toys in the mail. Just need the router and I'll be set.
    – Hal Jordan
    Commented Apr 13, 2012 at 22:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .