SSH to switch on OUTSIDE of old PIX Firewall

Question

A branch office has a small 2950 in front of their PIX firewall (so failover can plug into it. The upstream router (owned by teleco company) only has one input port). I'm attempting to manage the device remotely.

The PIX is the gateway for everything in the office: 10.1.128.254 The switch has management setup: 10.1.128.249

I've added ACL allowances for remote management (SSH), and a static route specifically for managing this device. Doing these two things has allowed me to be able to ping the device (from the PIX) but not from machines on the inside.. Remote access via SSH (putty) still unsuccessful.

I've packet-traced from inside to 10.1.128.249 and nothing is preventing this communication that I can see. Thanks in advance all!

EDIT: Assume that I cannot connect this to the internal network (physically).

Answer 1

I typically set up such DMZ switches with a dedicated management interface with layer two access to the inside network, so that management access bypasses the firewall entirely. Since the 2950 does not have a dedicated management interface, you could simply designate a separate VLAN for management, configure its SVI, and assign to an access port which connects to the inside network. This ensures that you will have access to the switch in the event of a firewall failure for troubleshooting.

(Note that Internet access from the switch will go through the inside network, the firewall, and pass back through the switch itself; it will not have direct outside connectivity.)