I have just a general question about the routing on firewall interfaces.
If I have a firewall inside interface 10.1.1.1
And my DMZ is 192.168.1.1
Say I have a host in the DMZ 192.168.1.100.
My workstation is 10.1.1.100 and I am using the firewall inside interface as my default gateway.
I should have a one to one access-list for:
static (inside,DMZ) 10.1.1.0 10.1.1.0 netmask 255.255.255.0 0 0
When this is done, my understanding is that the DMZ host will see my workstation on the 10.1.1.0 network.
If the above is all true (and this seems too simple), then the firewall is routing the packet, but why do I need the static?
Why can't the firewall do that without it?