Can someone explain how NO NAT is secure?

chris.mcpeak · ‎03-30-2007

Can someone either explain the concept of a NO NAT config in a PIX 506 or supply me w/ a good configuration example? I don't see how this can be a secure method. If I had an Access-List 101 I would have to permit 0.0.0.0 ---> the same public address. Also, wouldn't I need a static mapping from public address ----> to ----> public address? Does NO NAT confuse anyone else out ther?

acomiskey · ‎03-30-2007

Are you talking about something like this?

access-list 101 permit ip 192.168.1.1 255.255.255.0 172.16.0.0 255.255.255.0

nat (inside) 0 access-list 101

This is typically done to exempt traffic from nat for use with remote access or lan to lan vpn tunnels. Traffic defined in the acl would be exempted from nat even if you had something like...

global (outside) 1 interface

nat (inside) 1 0 0

...because nat exemption is first in the nat order of operations. Not sure about the second part of your question.