PIX: can I use public IPs for NAT not from the outside network,

[vili.ivanov]

but from a different network that has been routed to the outside interface, and how would i define the pool if i need to define it. please.

[rrbleeker]

Yes, you can use a network for address translation different than the one assigned to your outside network. As long as a route for this network to the PIX exist. You define the pool as follow:

global (outside) 1 206.99.2.1-206.99.2.30 netmask 255.255.255.224

Assuming that you use NAT id 1.

[vili.ivanov]

That works, Great! Now can I do this, have two networks for which the pix can do nat, setup kind of like this:

ip address outside 63.240.68.244 255.255.255.248

ip address inside 10.15.58.254 255.255.255.0

nat (inside) 1 10.15.49.0 255.255.255.0 0 0

nat (inside) 1 10.15.58.0 255.255.255.0 0 0

global (outside) 1 63.240.71.117-63.240.71.126 netmask 255.255.255.240

sh route

outside 0.0.0.0 0.0.0.0 63.240.68.241 1 OTHER static

inside 10.15.49.0 255.255.255.0 10.15.58.1 1 OTHER static

inside 10.15.58.0 255.255.255.0 10.15.58.254 1 CONNECT static

outside 63.240.68.240 255.255.255.248 63.240.68.244 1 CONNECT static

and can I do static nat for the network that is not directly connected to the firewall, sort of like this:

static (inside,outside) 63.240.71.114 10.15.49.6 netmask 255.255.255.255 0 0

static (inside,outside) 63.240.71.115 10.15.49.5 netmask 255.255.255.255 0 0

now what I would like to know is if this should work, and if I am missing something. It doesnt seem to be working although I see echo requests ont the debug packet inside both proto icmp, no denies on the syslog, but no replies either! Any thoughts?

[vili.ivanov]

scratch the previous. it works.

[c.reglat]

HI,

If you have no echo reply it might be because you need to open a conduit which will let your outside connection get to your inside ips.

static (inside,outside) 63.240.71.114 10.15.49.6 netmask 255.255.255.255 0 0

the above static command will allow you to get out only.