Removing a static nat on Pix 515E

tbarberio · ‎04-30-2007

I have a static nat table with this rule

( i have put in X to cover my publci ip for security reasons for this post)

static (inside,outside) 65.91.XXX.XX 192.168.211.1 netmask 255.255.255.255 0 0

How do I remove just that one line without clearing the entire table?

Patrick Iseli · ‎04-30-2007

You just need to put the statement in front of the line !

no static (inside,outside) 65.91.XXX.XX 192.168.211.1 netmask 255.255.255.255 0 0

Usulaly after changing the NAT to clear the translation table:

clear xlate

But take care this will reset all connections.

sincerely

Patrick

Fernando_Meza · ‎04-30-2007

Hi .. add the no in front of the sentence no static (inside,outside) 65.91.XXX.XX 192.168.211.1 netmask 255.255.255.255 0 0 and then type in clear xlate global 65.91.XXX.XX netmask 255.255.255.255. In that way you will not affect the other connections.

I hope it helps .. please rate it if it does

hussainkhalid · ‎07-04-2007

I need to do the same, but it gives me some error

ERROR: % Invalid input detected at '^' marker.

i have seen something in

sh xlate

and it shows me the same

Global XXX.XXX.XXX.XXX Local XXX.XXX.XXX.XXX

Do i need to remove the this also because it is the same NAT which i want to remove.

how do i remove this as well?

clear xlate? what is xlate? are these active connections? what if i say clear xlate? will it remove the xlate entries permanently? please help!

Jon Marshall · ‎07-04-2007

Hi

To clear an an an xlate entry use the command Fernando sent. This will remove the specific xlate entry.

Xlate is the translation table that the pix uses for NAT translations. If you say "clear xlate" you remove all the current translations which means that all existing connections through the firewall will be dropped, probably not something you want to do in a production environment :-)

The xlate entries are dynamically added so if you remove it the next time the connection is made the entry will reappear. If you want to ensure that an xlate entry never returns you need to remove the corresponding nat entry from your configuration.

HTH

Jon

hussainkhalid · ‎07-04-2007

no static (Inside,Outside) 62.215.215.215 62.215.215.215 netmask 255.255.255.255

^ clear global 62.215.215.215 Local 62.215.215.215

ERROR: % Invalid input detected at '^' marker.

I GET THIS ERROR MESSAGE! PLEASE HELP ON THIS!

Jon Marshall · ‎07-04-2007

Hi

Instead of typing this

clear global 62.215.215.215 Local 62.215.215.215

try

clear xlate global 62.215.215.215

BUT before you do this type

"sh xlate"

If the entry for 62.215.215.215 is not in the xlate table you don't need to clear it.

HTH

Jon

hussainkhalid · ‎07-05-2007

didnt work, doesnt give any error but when i say

sh xlate

the entry is still there!

do i need to remove NAT before that?

Jon Marshall · ‎07-05-2007

Hi

Can you post the running config of your firewall + the output of a "sh xlate"

Jon

hussainkhalid · ‎07-05-2007

sorry, cannot!

hussainkhalid · ‎07-09-2007

i tried to delete the static nat and xlate...doesnt work! xlate doesnt give any error but still shows in the list...and static nat gives error on that command...

ERROR: % Invalid input detected at '^' marker.