HI.
It depends first on the answer to the following question:
Do you wish to use private (hidden) ip addresses or public registered addresses on the DMZ network?
If you're going to use private ip addresses, then "nat 0" will not work of course.
I use static for single IP, and nat 0 for subnets.
It is difficult for me to explain why, but I will try to:
* This is what I've learned from the pix manuals (use static for inbound translation).
* It seems to me easier to manage (access-list can make it a bit more complex).
* I think that static involves less processing at the pix. static is simply a permanent entry in the translation table. nat 0 access-list will need to be processed on each packet, and for traffic originating from other hosts in the dmz (since nat 0 is bound to an interface).
* Static involves proxy-arp. This could be an advantage if the registered ip is in the same subnet as the pix outside network because the perimeter router does not need a static route to find the address (in that case).
However, if you are using registered addresses at the dmz, then using "nat 0" for the whole dmz network is a good idea:
nat (dmz) 0 0 0
To conclude, I will repeat my rule of thumb:
If you wish to publish a single host, use static.
To publish the whole dmz, use "nat 0" for the whole subnet.
Yizhar
