Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Setup PIX without NAT

I have a PIX 515E in place and it is running NAT. I would like to take off the NAT and not have any address translation. I have never setup a PIX this way. What do I do?

Bill E.

4 REPLIES
Cisco Employee

Re: Setup PIX without NAT

When the NAT command is used with the special number 0 this tells the PIX not to NAT any of the traffic. In it's most basic form you cna just do:

nat (inside) 0 0 0

The first 0 says don't NAT the traffic, the second two zeroes define the subnet/mask of the traffic to NAT. If you want to get more specific then you can do something like this (assuming you'r inside network is 200.0.0.0/8):

nat (inside) 0 200.0.0.0 255.0.0.0

Then only traffic from the 200.0.0.0 network will not be NAT'd. When using "nat 0" you don't need a corresponding global statement cause the whole point of it is that the addresses aren't changed to something else. You cna also do:

nat (inside) 0 access-list nonat

access-list nonat permit ip 200.0.0.0 255.0.0.0 any

This is primarily used for VPN traffic where you don't want to NAT it as it goes through, but is just as valid for any other traffic also.

See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/mr.htm#1032129 for further details.

New Member

Re: Setup PIX without NAT

Thank you for your post. Although that information is helpful, its not exactly what I was looking for. I actually want to not use NAT. How would I do this?

Bill

Re: Setup PIX without NAT

Bill,

The PIX requires that you create translations across interfaces in order for traffic to pass. So, in essence, there is no option to not use NAT in some form. As Glenn pointed out though, you can configure the PIX to NAT the source address back to the same address as it passed from inside to outside. In practice, this gives you the same results as not NAT'ing the traffio on the PIX as the outside hosts will see the original source address on this packet.

Clearer?

Scott

New Member

Re: Setup PIX without NAT

But if you are using the PIX in an extranet environment, you must NAT the global addresses you wish nodes outside of the pix to use (for inbound), correct?

237
Views
0
Helpful
4
Replies
CreatePlease login to create content