Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

PIX Multiple "NAT Subnets" per interface ?

Not entirely sure how to explain this so here goes.

Is it possible to use NAT/global or static statements for subnets not physically connected to the PIX ?

Problem is we have run out of address space on our external interface and want to add a static nat for new device using another subnet address.

Existing config eg:

static (inside,outside) 172.16.253.250 10.128.1.10 netmask 255.255.255.255 0 0

(Where 172.16.253.250 is part of physicall connected subnet.)

Required new NAT:

static (inside,outside) 172.16.252.249 10.128.1.13 netmask 255.255.255.25 5 0 0

(where 172.16.252.249 is not part of the physically connected subnet)

This is something we use frequently on our other firewalls but the first time we have tried on PIX. Is it possible ? If so How ?

4 REPLIES
Hall of Fame Super Blue

Re: PIX Multiple "NAT Subnets" per interface ?

Hi

Yes it is entirely possible and you would do it as you have done with your static statements. What you have to ensure is that any traffic for the subnet 172.16.252.x ie. the one not connected physcially, gets routed to the outside interface of your pix.

HTH

Jon

Community Member

Re: PIX Multiple "NAT Subnets" per interface ?

Well I thought it should be possible. Am I right in thinking the static applies in both directions, i.e. connections made from the inside device (10.128.1.13) should appear to the outside world as 172.16.252.249.

Currently I'm not seeing a thing on the outside interface so tomorrow I need to get a sniffer on the job.

Cisco Employee

Re: PIX Multiple "NAT Subnets" per interface ?

ping anything on outside from the host 10.128.1.13 and turn on debug icmp trace on the firewall

Cisco Employee

Re: PIX Multiple "NAT Subnets" per interface ?

yes this is possible

Upstream router----(out)Pix(in)----inside

out =172.16.253.250/24

Now for your required static to work you need to add a route on the upstream router that points 172.16.252.249 to firewall outside interface address

ip route 172.16.252.249 255.255.255.0

let me know once it works !

371
Views
0
Helpful
4
Replies
CreatePlease to create content