Cisco Support Community
Community Member

The problem has been solved! The custom's host has another path to outside.

I config the static nat in pix and use global / nat command to make source nat for inside host's internet connection. But when i try to connect the map ip config in pix as static ip, it dosen't work. I sniffor the packet and find the the source ip address which response from remote server(pix) is still the private ip address of the inside host, and hasn't been translate to public ip address.

and the ping result is :

C:\>ping 218.x.179.3 -t

Pinging 218.x.179.3 with 32 bytes of data:

Reply from bytes=32 time=25ms TTL=55

218.x.179.3 is the map ip address. is the host ip address.

and show xlate is :

4 in use, 14 most used

Global 218.x.179.4 Local

Global 218.x.179.3 Local

Global 218.x.179.5 Local

Global 218.x.179.6 Local

seems ok, too.

why pix dose't translate the inside ip to the map ip? is it bug in 6.3(1) os???

the configuration is the following:

pixfirewall# sho run

: Saved


PIX Version 6.3(1)

interface ethernet0 100basetx

interface ethernet1 100basetx

interface ethernet2 auto shutdown

interface ethernet3 auto shutdown

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet2 intf2 security4

nameif ethernet3 intf3 security6

enable password xxx

passwd xxx

hostname pixfirewall

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521


access-list acl_in permit ip any any

access-list acl_in permit icmp any any

pager lines 24

mtu outside 1500

mtu inside 1500

mtu intf2 1500

mtu intf3 1500

ip address outside 218.x.x.2

ip address inside

no ip address intf2

no ip address intf3

ip audit info action alarm

ip audit attack action alarm

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0 0

static (inside,outside) 218.x.x.4 netmask 0 0

static (inside,outside) 218.x.x.5 netmask 0 0

static (inside,outside) 218.x.x.6 netmask 0 0

static (inside,outside) 218.x.x.3 netmask 0 0

access-group acl_in in interface outside

route outside 0.0.x.x.77.179.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet timeout 5

ssh timeout 5

console timeout 0

terminal width 80


: end


Re: The problem has been solved! The custom's host has another p

Hi ... I suggest you to upgrade to latest 6.3 (5) version ... your config seems OK.

I hope it helps ... please rate it if it does !!!

CreatePlease to create content