cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
548
Views
0
Helpful
4
Replies

PIX Multiple "NAT Subnets" per interface ?

PIXMayhem
Level 1
Level 1

Not entirely sure how to explain this so here goes.

Is it possible to use NAT/global or static statements for subnets not physically connected to the PIX ?

Problem is we have run out of address space on our external interface and want to add a static nat for new device using another subnet address.

Existing config eg:

static (inside,outside) 172.16.253.250 10.128.1.10 netmask 255.255.255.255 0 0

(Where 172.16.253.250 is part of physicall connected subnet.)

Required new NAT:

static (inside,outside) 172.16.252.249 10.128.1.13 netmask 255.255.255.25 5 0 0

(where 172.16.252.249 is not part of the physically connected subnet)

This is something we use frequently on our other firewalls but the first time we have tried on PIX. Is it possible ? If so How ?

4 Replies 4

Jon Marshall
Hall of Fame
Hall of Fame

Hi

Yes it is entirely possible and you would do it as you have done with your static statements. What you have to ensure is that any traffic for the subnet 172.16.252.x ie. the one not connected physcially, gets routed to the outside interface of your pix.

HTH

Jon

Well I thought it should be possible. Am I right in thinking the static applies in both directions, i.e. connections made from the inside device (10.128.1.13) should appear to the outside world as 172.16.252.249.

Currently I'm not seeing a thing on the outside interface so tomorrow I need to get a sniffer on the job.

ping anything on outside from the host 10.128.1.13 and turn on debug icmp trace on the firewall

abinjola
Cisco Employee
Cisco Employee

yes this is possible

Upstream router----(out)Pix(in)----inside

out =172.16.253.250/24

Now for your required static to work you need to add a route on the upstream router that points 172.16.252.249 to firewall outside interface address

ip route 172.16.252.249 255.255.255.0

let me know once it works !

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: