Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

PIX Multiple "NAT Subnets" per interface ?

Not entirely sure how to explain this so here goes.

Is it possible to use NAT/global or static statements for subnets not physically connected to the PIX ?

Problem is we have run out of address space on our external interface and want to add a static nat for new device using another subnet address.

Existing config eg:

static (inside,outside) netmask 0 0

(Where is part of physicall connected subnet.)

Required new NAT:

static (inside,outside) netmask 5 0 0

(where is not part of the physically connected subnet)

This is something we use frequently on our other firewalls but the first time we have tried on PIX. Is it possible ? If so How ?

Hall of Fame Super Blue

Re: PIX Multiple "NAT Subnets" per interface ?


Yes it is entirely possible and you would do it as you have done with your static statements. What you have to ensure is that any traffic for the subnet 172.16.252.x ie. the one not connected physcially, gets routed to the outside interface of your pix.



Community Member

Re: PIX Multiple "NAT Subnets" per interface ?

Well I thought it should be possible. Am I right in thinking the static applies in both directions, i.e. connections made from the inside device ( should appear to the outside world as

Currently I'm not seeing a thing on the outside interface so tomorrow I need to get a sniffer on the job.

Cisco Employee

Re: PIX Multiple "NAT Subnets" per interface ?

ping anything on outside from the host and turn on debug icmp trace on the firewall

Cisco Employee

Re: PIX Multiple "NAT Subnets" per interface ?

yes this is possible

Upstream router----(out)Pix(in)----inside

out =

Now for your required static to work you need to add a route on the upstream router that points to firewall outside interface address

ip route

let me know once it works !

CreatePlease to create content