A branch office has a small 2950 in front of their PIX firewall (so failover can plug into it. The upstream router (owned by teleco company) only has one input port). I'm attempting to manage the device remotely.

The PIX is the gateway for everything in the office: The switch has management setup:

I've added ACL allowances for remote management (SSH), and a static route specifically for managing this device. Doing these two things has allowed me to be able to ping the device (from the PIX) but not from machines on the inside.. Remote access via SSH (putty) still unsuccessful.

I've packet-traced from inside to and nothing is preventing this communication that I can see. Thanks in advance all!

EDIT: Assume that I cannot connect this to the internal network (physically).

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 8, 2017 at 14:23

1 Answer 1


I typically set up such DMZ switches with a dedicated management interface with layer two access to the inside network, so that management access bypasses the firewall entirely. Since the 2950 does not have a dedicated management interface, you could simply designate a separate VLAN for management, configure its SVI, and assign to an access port which connects to the inside network. This ensures that you will have access to the switch in the event of a firewall failure for troubleshooting.

(Note that Internet access from the switch will go through the inside network, the firewall, and pass back through the switch itself; it will not have direct outside connectivity.)

  • Cool, that definitely sounds like a workable solution and they have a guy on-site I may be able to help do this. I still want to know how to do it assuming I COULDN'T do this in the future. Some branch sites don't have staff that could help me out and general curiosity has me now.
    – A L
    Commented Aug 13, 2013 at 14:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.