How you call this type STATIC ?

amarula115 · ‎10-01-2008

How you call properly this type of STATIC:

static (inside,outside) 172.16.32.0 172.16.32.0 netmask 255.255.255.0

and what is the purpose of such STATIC?

Jon Marshall · ‎10-01-2008

It is static because the translation is not dynamically created when traffic goes through the firewall. This a permanent translation that you want all the time.

The purpose is because of an oddity with the pix/asa device. To allow traffic from a lower to a higher security level interface you need to

i) allow it in an access-list

ii) have a NAT statement for it

On most other firewalls you only NAT if you want to represent one address as another address. On pix/asa even if you don't want to change the address because of ii) you must have a nat statement and that is why you have it. It is almost a way of saying to the pix/asa i don't want to NAT for 172.16.32.0.

As i say it is an oddity of the pix/asa firewalls.

Jon

cisco24x7 · ‎10-01-2008

you either use static (i,o) same-ip same-ip

or nat(inside) 0 access-list with Pix version

6.3(x).

With version 7.x, you do not have to do this

if you have "no nat-control". That will

allow traffic from high to low.

HOWEVER, AS SOON AS YOU HAVE nat (inside) 1 x x

and global (outside) 1 interface, "NO NAT-CONTROL" WILL BECOME USELESS FOR

INTERFACE "INSIDE"

amarula115 · ‎10-01-2008

thank you

amarula115 · ‎10-01-2008

Thank you