PIX Multiple "NAT Subnets" per interface ?

Unanswered Question
Mar 17th, 2008

Not entirely sure how to explain this so here goes.

Is it possible to use NAT/global or static statements for subnets not physically connected to the PIX ?

Problem is we have run out of address space on our external interface and want to add a static nat for new device using another subnet address.

Existing config eg:

static (inside,outside) netmask 0 0

(Where is part of physicall connected subnet.)

Required new NAT:

static (inside,outside) netmask 5 0 0

(where is not part of the physically connected subnet)

This is something we use frequently on our other firewalls but the first time we have tried on PIX. Is it possible ? If so How ?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Mon, 03/17/2008 - 06:29


Yes it is entirely possible and you would do it as you have done with your static statements. What you have to ensure is that any traffic for the subnet 172.16.252.x ie. the one not connected physcially, gets routed to the outside interface of your pix.



PIXMayhem Mon, 03/17/2008 - 11:03

Well I thought it should be possible. Am I right in thinking the static applies in both directions, i.e. connections made from the inside device ( should appear to the outside world as

Currently I'm not seeing a thing on the outside interface so tomorrow I need to get a sniffer on the job.

abinjola Mon, 03/17/2008 - 11:55

ping anything on outside from the host and turn on debug icmp trace on the firewall

abinjola Mon, 03/17/2008 - 06:52

yes this is possible

Upstream router----(out)Pix(in)----inside

out =

Now for your required static to work you need to add a route on the upstream router that points to firewall outside interface address

ip route

let me know once it works !


This Discussion