Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

nat,global & dmz mixed up!

hi

i am try to configure pix 515 with in,out and one dmz. the webserver in dmz is connected thru wan link. here is my nat and global

global (outside) 1 203.1xx.1xx.x

global (outside) 2 interface

global (DMZ1) 2 202.54.212.1xx netmask 255.255.255.224

nat (inside) 2 10.120.10.0 255.255.255.0 0 0

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

only users in 10.120.10.0 network can access dmz, but they also need access to internet thru outside. with this config they can access it. but there is one more network which needs access to this dmz server.now if i put nat:

nat (inside) 2 202.9.20x.0 255.255.255.0 0 0

they can access the dmz but CANNOT browse internet thru outside. if i remove it they can access the net but not dmz.

any advise pls. will be of gr8 hlp

thx

2 REPLIES
New Member

Re: nat,global & dmz mixed up!

Check if there are two seperate return paths for both the NATstatements. The order of NAT is explained in the following document which might give you an idea.

http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080133ddd.shtml

Gold

Re: nat,global & dmz mixed up!

basically all inside hosts need access to both internet and dmz, right? and you want inside hosts to be NATted into different public ip when browsing internet, right? also ,assuming no traffic will be initialised from dmz to inside

no global (DMZ1) 2 202.54.212.1xx netmask 255.255.255.224

static (inside,DMZ1) netmask 255.255.255.0 0 0

you don't need access-list if you haven't got one for inside interface. if you do, then you have to do

access-list xxx permit ip

134
Views
0
Helpful
2
Replies