Two PIX on same subnet with same gateway?

We have two pix on the same subnet: one to the internet and one to an ASP.
Between them we have a router that does ISDN dial-backup also on the same
subnet. When we route outside traffic through PIX 1 to the router and then
to PIX2 we can ping but cannot telnet to the ASP. But when we point the
PIX's at each other take the router out of the picture the telnet to the ASP
works fine, but of course then the ISDN dial-backup router is out of the
loop.

Any ideas?

Thanks!

 

I'm guessing your network looks something like:

+PIX1---->Internet
|
LAN------+Router-->ISDN Dial
|
+PIX2---->ASP

If so, how about:

Default gateway on the LAN is Router.
Static route on Router to the ASP host/network via PIX2
e.g. for a host
ip route a.b.c.d 255.255.255.255 [PIX2 inside address]

OSPF between PIX1 and Router, routing as follows:
ISDN dial routing static on an administrative distance of 200
Default route on PIX1 redistributed in OSPF - this should (if memory
serves correctly) appear as a candidate default route on the router
with an admin distance of 170

Assuming a) PIX1 is on 6.3, b) IOS on the router supports OSPF and c)
the network topology guess is correct.

 

:We have two pix on the same subnet: one to the internet and one to an ASP.
:Between them we have a router that does ISDN dial-backup also on the same
:subnet. When we route outside traffic through PIX 1 to the router and then
:to PIX2 we can ping but cannot telnet to the ASP. But when we point the
IX's at each other take the router out of the picture the telnet to the ASP
:works fine, but of course then the ISDN dial-backup router is out of the
:loop.

Could you provide a bit of a network diagram? In particular, I'm
unclear on how the router fits in considering they are on the same
subnet? Are you bridging the subnet across the router, or using
"ip unnumbered", or something else?

 

I assume that it's a fixed subnet that you route to your ASP and not
everything. This might be a proxy-arp issue and assuming that your
static routes are correct, each pix has the correct static routes to
the router and vis versa then on the routers ethernet interface I
would configure no ip proxy-arp and on the two pix sysopt noproxyarp
inside. Again assuming the static routes are correct.

 

Thanks to you and everyone for trying and sorry I didn't provide enough
info.

My Cisco "expert" is coming onsite tomorrow to figure it out and I'll let
you know what he did.