Hi

In that case surely the Firewall will not perform the NAT . But lets assume for now that the client will be needing both DNS and www traffic to qualify for NAT translation.

We can impose this restriction to the customer easily since for going to the Internet he have to perform a web-login thorough our portal.

Waiting for your valued response.

Abhishek

Mmmmm interesting one - I think you could try policy based NAT, something like:-

access-list customer-nat permit tcp host x.x.x.x any eq 80

access-list customer-nat permit udp host x.x.x.x any eq 53

static (inside,outside) y.y.y.y access-list customer-nat

The above ONLY allows the translation to the outside on a specific IP address from a specific inside host?

OR if you don't want to give a specific static IP:-

global (outside) 666 interface

nat (inside) 666 access-list customer-nat

Means the customer host will use the outside interface IP.

You can mix and match with the above examples....you could have multiuple customer using the same IP address - just PAT it. The there is a limit on the number of PAT sessions per NAT address.....65535!!!

Don;t think you would reach that! One more thing - you can'd do the above in any code lower than 7.x

HTH>