Hi
There are a lot of things to cover here - let me know if you need further clarification.
1) if you want to put the pix behind the router then you will need another subnet to connect the pix external interface to the router internal interface.
So you don't have to setup up new default gayeways for your clients i suggest you move the 172.18.1.1 address to the pix inside interface.
The use another subnet for the pix outside/router inside interface.
For examples sake lets say you allocate 172.19.1.0/28 for this.
Pix outside interface 172.19.1.1
router internal interface 172.19.1.2
2) On the router you will need to add a route for the internal network
ip route 172.18.1.0 255.255.255.0 172.19.1.1
3) On the pix you need a default route pointing to the router
route outside 0.0.0.0 0.0.0.0 172.19.1.2
4) You don't say where you want to do the NAT for your clients and these two machines you are giving access to. Lets assume you are going to leave it on the router
On the pix
nat (inside) 0 0.0.0.0 0.0.0.0
This tells the pix not to NAT any clients as they go out. The NAT will still be done on your router.
5) You still need to do something about the 2 machines. On the pix
static (inside,outside) 172.18.1.151 172.18.1.151 netmask 255.255.255.255
static (inside,outside) 172.18.1.152 172.18.1.152 netmask 255.255.255.255
The NAT to public addressing will still happen on your router.
5) You will need to have an access-list on the outside interface of your pix for access to these 2 machines.
You don't say which hosts and what ports so you will need to modify this access-list.
access-list acl_inbound permit host "x.x.x.1" 172.18.1.151 eq 23
access-list acl_inbound permit host "x.x.x.1" 172.18.1.152 eq 23
access-list acl_inbound permit host "x.x.x.2" 172.18.1.151 eq 23
access-list acl_inbound permit host "x.x.x.2" 172.18.1.152 eq 23
Note if you are familiar with object groups you could simplify this a bit.
Hope this makes sense.
Jon
