Hi. Jon. Thnks for your answer. In general, this is the main settings of our PIX. Remenber that the idea is the DMZ4 to access to internet by 200.12.176.62 and the ip address 200.12.181.2 is for the another networks:

nameif ethernet0 outside security0

nameif gb-ethernet0 dmz4 security20

ip address outside 200.12.181.1 255.255.255.0

ip address dmz4 172.16.0.1 255.255.0.0

global (outside) 1 200.12.181.2

global (dmz4) 1 200.12.176.62

global (dmz2) 1 200.12.180.126

global (dmz3) 1 200.12.187.254

nat (dmz4) 1 172.16.0.0 255.255.248.0 0 0

static (dmz4,outside) 172.16.0.0 200.12.176.48 netmask 255.255.255.240 0 0

thanks again for your help.

Francisco Velasco

Hi Francisco

Okay your problem is this:

nat (dmz4) 172.16.0.0 255.255.248.0 0 0

global (outside) 1 200.12.181.2

This translates all your hosts on dmz4 to 200.12.181.2.

You then have a static statement

static (dmz4,outside) 172.16.0.0 200.12.176.48 netmask 255.255.255.240 0 0

There are a few things wrong with this statement

1) it's the wrong way round ie. it should read

static (dmz4,outside) 200.12.176.48 172.16.0.0 netmask 255.255.255.240 0 0

2) If someone from the outside of the pix wants to access one of the 172.16.0.0 servers with this statement how will they know which address to go to ie. if a user on the outside contacts 200.12.176.50 how does the pix know which 172.16.x.x host this is destined for.

If you want to translate just one host from DMZ4 you could use

static (dmz4,outside) 200.12.176.49 172.16.1.1 netmask 255.255.255.255

(this is just an example - i have no idea what 172.16.x.x addressing your dmz4 servers are using).

You can statically translate more up to the number of available IP addresses from the 200.12.176.40 subnet.

With these static translations a user on the outside will be able to access the DMZ4 server as long as you allow it thru an access-list. So from the above example if a user from the outside sends a packet to 200.12.176.49 and you have allowed it in your access-lists then the packet will go to 172.16.1.1.

If you don't need any servers to be contacted from the outside and are only interested in the servers going from the dmz4 to the outside remove your static and change the following.

nat (dmz4) 2 172.16.0.0 255.255.248.0

global (outside) 2 200.12.176.62

Hope all that is clear. Any queries let me know.

Jon

Hi, Jon.

I done this instructions but in this case any host on the DMZ4 can access the Internet. I think that if is necesary the line "nat (dmz4) 1 172.16.0.0 255.255.248.0 0 0" or not? I apreciate your help and I wait for your response.

Francisco.

Hi Francisco

Could you just clarify. Do you want all hosts on your DMZ to be able to access the Internet or just one of the hosts ?

Jon

Hi Jon. Please, excuse me, but I had a mistake in the ip address (200.12.176.62) because that address is not available to access directly to internet, there were a restiction in the PIX with that address. I checked it and now is working perfectly. But I apreciate a lot your help, it was very important for me. I hope that I can write to you for future questions.

You have a nice day.

Francisco Velasco