Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

The behavior of static (inside, outside) 4.2.2.10 4.2.2.10

Hey guys,

How does this command react in following configuration.

static (inside, outside) 4.2.2.10 4.2.2.10

Config:

Pix with two interfaces

inside ip add 10.0.0.1/24

outside ip add 4.2.2.1/24

I have a server on the inside that I needs(due to some software limitation) to have the ip address 4.2.2.10.

Questions?

Can a device on the inside of the pix be configured on the same network as the outside interface? ie 4.2.2.x network.

Will the static command forward the inbound Internet traffic (dest=4.2.2.10) to the server on the inside interface?

Thanks in advance

Craig

1 REPLY
Cisco Employee

Re: The behavior of static (inside, outside) 4.2.2.10 4.2.2.10

> Questions?

> Can a device on the inside of the pix be configured on the same network as the outside interface? ie 4.2.2.x network.

The device can have any IP address it wants, regardless of what is on the PIX. If your question is really asking "Can a device on the inside of the pix be configured on the same network as the outside interface AND STILL COMMUNICATE OUT THROUGH THE PIX", then the answer is no. The PIX is going to see the source address, see that it should be on the outside interface, and drop the packet.

> Will the static command forward the inbound Internet traffic (dest=4.2.2.10) to the server on the inside interface?

Possibly. The PIX does actually take the commands as you entered them, but they don't make sense. Normally when doing no-NAT, the static command takes the format:

static (high,low) high high

but what you have is:

static (high,low) low low

The PIX may pass this through, but more likely what it'll do is receive the packet for 4.2.2.10, run it through the static which won't change the destination address, then it'll look up it's forwarding table to see what interface it should go out on. This will be the outside interface rather than the inside, and because the PIX won't send a packet back out the same interface it came in on, the packet will be dropped.

This is all guess work actually, cause I can't say I've ever tried what you're doing. I will take any odds though that it won't work, either because the PIX drops it on the way in, or it drops it on the way back from the host.

86
Views
0
Helpful
1
Replies