Accessing server on other network throught NAToutside
OK, I need some ideas how to solve this problem. This will be a quite brainstorming for you ;).
IP addresses are not real, but as in my real situation they are public IANA addresses :).
I will describe network situation:
PIX running PIXOS6.3 with three interfaces:
1.inside - 18.104.22.168/24 (sec-level 100)
2.outside - x.x.x.x (sec-level 0) - Internet
3.projectVLAN - 192.168.50.0/24 (sec-level 60)
On inside network is another subnet 22.214.171.124/24 behind router. PIX has route to this subnet
"route inside 126.96.36.199 255.255.255.0 188.8.131.52" (this is ROUTER2 IP)
Users from projectVLAN can access inside
servers using configured static(s) with ACLpermits on projectVLAN interface.
Problem is when users wants to access servers on subnet 184.108.40.206/24 trought static. Communication is not successfull, because traffic is not returning correctly. ROUTER2 on 220.127.116.11/24 is on other WAN location and do not have route to hosts on 192.168.50.0/24 throught PIX IP 18.104.22.168/24.
Therefore I have used static with conjuction "nat outside". Translates destIP and also sourceIP, of which ROUTER2 is aware of(know route to it). Connect to server(tested throught ping is now successfull), but all other communication from inside to projectVLAN do not pass(is blocked) with this syslog message on PIX:
"%PIX-3-305005: no translation group found for ICMP ..."
Here is short cut-out from config(I hope you will be able to see all needed stuff - sry for mistakes, this is not pasted but manually written - hope syntax is good :)
Re: Accessing server on other network throught NAToutside
Think the problem is that you are translating all the projectVLAN servers to the inside interface IP address which is fine when you come from the projectVLAN to the inside. But when you try pinging from inside to projectVLAN the pix has no way of knowing which server on the projectVLAN you are trying to get to.
You have a couple of options.
1) The easiest, but probably not what you want, is to just advertise the 192.168.50.0 network on your internal routers but this is messy for your routing tables.
2) The second is to have static translations presenting the projectVLAN servers to the inside. You will need an unused NAT pool for these translations. You will still need a route within your internal routing tables for this subnet pointing to the internal interface of the pix. The advantage over 1) is that you can keep your routing tables more consistent eg. say you have a spare class C 22.214.171.124/24. You can setup translations as such
static (pVLAN,inside) 126.96.36.199 192.168.50.x (x being one of the pVLAN servers)
static (pVLAN,inside) 188.8.131.52 192.168.50.x
2 is preferable but you do need a spare subnet ( doesn't need to be a whole class c ) and you still need to ensure there is a route internally for this subnet pointing to the Pix internal interface.
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...