Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Access to multiple networks behind PIX without static nat

I have 3 internal networks on pix inside interface, to access from outside or dmz to my internal servers I have to create static nat for all these networks on dmz, outside interface, and other interfaces(if i want to reach my server from that interface). Does this consume much memory ? Do you have any better configurations ?

What's outside nat for ?

  • Other Security Subjects
1 REPLY
Silver

Re: Access to multiple networks behind PIX without static nat

You can write static statements to cover entire NAT blocks. For example, this static NATs and entire internal network back to itself:

static (inside,dmz) 192.168.10.0 192.168.10.0 netmask 255.255.255.0

This one would NAT an internal network into another block, but the last octet would remain the same for the NATted sessions:

static (inside,outside) 30.15.20.0 192.168.10.0 netmask 255.255.255.0

So 192.168.10.25 would be NATted to 30.15.20.25, and so on....

You can also use NAT 0 so that NAT isn't performed on the IPs. Beware that this has the negative side effect of the translation not being available for access on the lower security interface until the host initiates a session going out first. Don't forget that inactive translations timeout.

-Shannon

83
Views
0
Helpful
1
Replies
This widget could not be displayed.