cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
618
Views
4
Helpful
2
Replies

Basic NAT-PAT configuration question

DAVMAC111
Level 1
Level 1

I want to configure a PIX 501 firewall for NAT - or more accurately PAT.

I want all inside users to be able to access the Internet using their non-routable IP adresses that the PIX will translate at the perimeter.

I only have one public IP address available.

I do not have a range as shown in the example below from:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v52/config/examples.htm#xtocid2

Start of example

nat (inside) 1 0 0

global (outside) 1 209.165.201.10-209.165.201.30

global (outside) 1 209.165.201.8

"Create a pool of global addresses that translated addresses use when they exit the firewall from the protected networks to the unprotected networks. The global command statement is associated with a nat command statement by the NAT ID, which in this example is 1. Because there are limited IP addresses in the pool, a PAT (Port Address Translation) global is added to handle overflow."

End of example

So, in my case, can I simply use the second global line to attain my objective?

Also, do I need to configure particular access-list entries in this case or will the PIX take care of everything automatically?

Thank you,

David

2 Replies 2

srue
Level 7
Level 7

best practice is the following:

nat (inside) 1 0 0

global (outside) 1 interface

you literally use the keyword 'interface' in the global command. it will use the outside interface IP, no matter what it is. you could also just use the outside IP there though. both accomplish NAT overloading / PAT.

Thanks for the answer!

Does the result look right (I'm going to test it now)?

pixfw(config)# nat (inside) 1 0 0

pixfw(config)# show nat

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

pixfw(config)# global (outside) 1 interface

outside interface address added to PAT pool

pixfw(config)# show global

global (outside) 1 interface

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: