If you have the following:
> global (outside) 1 100.1.1.1-100.1.1.254
then the PIX will just be doing NAT (one-to-one) translations, no PAT, and you'll only be able to create 254 connections outbound.
If you have the following:
> global (outside) 1 100.1.1.1-100.1.1.253
> global (outside) 1 100.1.1.254
then the PIX will do one-to-one NAT translations on the first 253 addresses available, and when they run out it will use .254 as a PAT address, giving you around 65000 additional connections (see below for a caveat to this).
If you want to create more PAT translations cause you're running out of them, then you do the following:
> global (outside) 1 100.1.1.1-100.1.1.252
> global (outside) 1 100.1.1.253
> global (outside) 1 100.1.1.254
If you need another PAT address, just remove .252 from the NAT pool and add another line similar to the .253 and .254 lines above, each one will give you additional connections.
CAVEAT
The PIX PATs addresses using the following rules:
- If the source port is TCP/UDP 1-511, then the PIX will PAT the SRC address to one in that range.
- If the source port is TCP/UDP 512-1023, then the PIX will PAT the SRC address to one in that range.
- If the source port is TCP/UDP 1024-65535, then the PIX will PAT the SRC address to one in that range.
So, if you have a large number of connections outbound with source ports below say, 500, then you will only get 500 translations out of one address, rather than the possible 65000. This all depends on what your internal SW uses as its source port, the norm is to use a high port (> 1024) in which case you'll get around 64900 translations per address.
