I am not sure if this is possible, but here goes. I have a PIX 525 using 4 interfaces, inside, outside, eng, and dmz. I would like to allow systems on inside, eng, and dmz to be reachable by their internal addresses (no NAT), but have them all NAT going the outside.
I have outlined in more detail below the configuration I am considering.
I have a PIX 525 running 5.3 with the following interfaces setup.
Security Interface IP Range
Security100 INSIDE 172.17.0.0/16
Security80 ENG 10.0.0.0/8
Security60 DMZ 192.168.1.0/24
Security0 OUTSIDE 22.214.171.124/24
I would like the INSIDE, ENG, and DMZ networks to be able to access each other via their actual private addresses without NAT. (For example a system on the ENG interface could contact a system on the INSIDE using it's 172.17.0.0/16 address and it would be seen as coming from its 10.0.0.0/8 address)
I would like to NAT(or PAT) the INSIDE, ENG, and DMZ networks only when they go out the OUTSIDE interface. The only access in from the OUTSIDE will be to select systems in DMZ.
I have some experience with other firewalls, but this is my first PIX, so I am not sure if I am even approaching this from correctly.
If I understand your problem going from a low security interface to a high security interface. You require a static for traffic to pass from low to high security interfaces like from ENG to INSIDE. For example
static (inside,ENG) 172.17.0.0 172.17.0.0 netmask 255.255.0.0 0 0 ***translates traffic from ENG network to the "as is" ip of a machine on the INSIDE network
DMZ to INSIDE
static (inside,DMZ) 172.17.0.0 172.17.0.0 netmask 255.255.0.0 0 0 ***translates traffic from DMZ network to the "as is" ip of a machine on the INSIDE network
DMZ to ENG
static (ENG,DMZ) 10.0.0.0 10.0.0.0 netmask 255.0.0.0 ***translates traffic from DMZ network to the "as is" ip of a machine on the ENG network
This looks a bit confusing these statics on the PIX are based on destination not source. The only source information required is which interface it is coming from.
Going from High security to low security can be done with the nat 0 (interface) access-list. I have never done this before but hopefully the config looks like this
From INSIDE to DMZ and ENG
You need an access-list. I'll call it no-nat-inside. This access-list says not to translate from 172.17.0.0/16 if going to 10.0.0.0/8 or 192.168.1.0/24
access-list no-nat-inside permit ip 172.17.0.0 255.255.0.0 10.0.0.0 255.0.0.0
access-list no-nat-inside permit ip 172.17.0.0 255.255.0.0 192.168.1.0 255.255.255.0
nat (INSIDE) 0 access-list no-nat-inside
Now repeat for the ENG to the DMZ
access-list no-nat-eng permit ip 10.0.0.0 255.0.0.0 192.168.1.0 255.255.255.0
nat (ENG) 0 access-list no-nat-eng
ACCESS to the outside world from each interface ....
nat (inside) 1 0.0.0.0 0.0.0.0
nat (ENG) 1 0.0.0.0 0.0.0.0
nat (DMZ) 1 0.0.0.0 0.0.0.0
global (outside) 1 126.96.36.199-188.8.131.52 netmask 255.255.255.0 *** a range of NAT ip's that you can define (63 in this example)
global (outside) 1 184.108.40.206 *** a single IP defaults to PAT up 65000 or so
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :