can't ping router behind pix with no nat

[harinirina]

Hi,

we need to remove nat 1 on our pix and apply nat 0 and configured pix like so.

Before, we could ping router behind pix, now , we can't anymore.

we use vlan, here's the config

[grant.maynard]

the line "nat (inside) 0 0.0.0.0 0.0.0.0 0 0"

means "don't nat anything from the inside interface". This is very unlikely to be what you want.

Normally you have:

access-list noNAT permit ip inside_subnets subnets_you_don't_want _to_NAT_to

nat (inside) 0 access-list noNAT

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

[harinirina]

That's what we really want to do, all traffic will not be natted when they pass through pix. They will be natted by the router behind the pix.

[grant.maynard]

IF you do not want the PIX to do any NAT, try this:

no nat-control

[fausto-oliveira]

You have two options :

1 - If you got the version 7.0 or superior you can turn the firewall to L2transparent where you don't need neither routing or NAT.

2 - You can do a Static (inside,outside) NETWORKADDRESS_INSIDE NETWORKADDRESS_INSIDE NETWORKMASK_INSIDE

This will do the trick of "not nating" the Inside IP addresses.

Please let me know if you run into any difficulties