now,the ebs router has a NM-1CE1U&NM-30DM,then remote clients can dial in the network,the pboc router has a wic-2t module,connect to remote side via DDN.the ebs interface's ip address of pix is x.x.45.2,the ebs router's ethernet ip address is x.x.45.1,and the ip address the remote client can get(the ip address pool) is from x.x.45.110-x.x.45.140.the ip address of pix515E 's inside interface is x.x.44.1.I use nat 0 0 0 to avoid any nat(image the pix as a router)then the strange thing happens,after configuration,in ebs router,can't ping any address who is like x.x.44.x,after server1 ping x.x.45.1,then both the dialer clients and the ebs router can ping server1,but can't ping server2,after server2 ping x.x.45.1(ebs router),both dialer clinets and ebs router can ping server2,etc.that means the inside computers must ping the outside computers first,then the outside computers can access(include ping) the inside server.and the even stanger thing is ,if there is no any traffic between ebs and the remote client(or the ebs router) in some time(maybe some hours,but I am not sure),the remote dialer clients or the ebs router can't ping(access) inside
servers.for instance,after one night,in the morning,the remote dialer clients or the ebs router can't ping x.x.44.x.It seems there is a time-out configuration,but how can I setup it?
Static commands make a permanent translation slot for traffic. In an environment with no nat (nat 0...), you use a netstatic (a static command for an entire block of IP addresses). This makes all of those hosts *potentially* accessible through the pix - you still need to open up the ports via a ACL or conduit.
Similar thing applies for natted environments, but there you typically have one static command per one server you want accessible. In PAT, you use statics to forward unique ports.
But why static? If you only use nat 0 - only *temporary* translation slots are created - so that if host A is sending outbound traffic to the internet, then host B (provided there is a access list/conduit that permits this behaviour) can make a connection to A. But if A stops sending any outbound traffic, eventually the temporary translation slot times out, and no external hosts can initiate connections to A. Hence the need for a mechanism through which permanent translation slots can be made.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
[toc:faq]Introduction:This document describes details on how NAT-T
works.Background:ESP encrypts all critical information, encapsulating
the entire inner TCP/UDP datagram within an ESP header. ESP is an IP
protocol in the same sense that TCP and UDP are I...