i am try to configure pix 515 with in,out and one dmz. the webserver in dmz is connected thru wan link. here is my nat and global
global (outside) 1 203.1xx.1xx.x
global (outside) 2 interface
global (DMZ1) 2 18.104.22.168xx netmask 255.255.255.224
nat (inside) 2 10.120.10.0 255.255.255.0 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
only users in 10.120.10.0 network can access dmz, but they also need access to internet thru outside. with this config they can access it. but there is one more network which needs access to this dmz server.now if i put nat:
nat (inside) 2 202.9.20x.0 255.255.255.0 0 0
they can access the dmz but CANNOT browse internet thru outside. if i remove it they can access the net but not dmz.
basically all inside hosts need access to both internet and dmz, right? and you want inside hosts to be NATted into different public ip when browsing internet, right? also ,assuming no traffic will be initialised from dmz to inside
no global (DMZ1) 2 22.214.171.124xx netmask 255.255.255.224
static (inside,DMZ1) netmask 255.255.255.0 0 0
you don't need access-list if you haven't got one for inside interface. if you do, then you have to do
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...