topic Re: PIX Global IP in Network Security

PIX Global IP

zulqurnain — Fri, 21 Feb 2020 08:50:34 GMT

can anyone just tell me that on PIX 515E is it important to have a global statement, meaning i have few ip address given by service provider out of which we have one setup for the global statement in pix. also we have NAT for different server.

problem which i face is that since the global statement is in place every ip going out is seen as the global ip even though i have setup NAT. i hope my point is clear. therefore i was planning to just drop the global statement but i am not so sure about the effect. any idea or help would be great.

Re: PIX Global IP

Patrick Laidlaw — Mon, 17 Apr 2006 05:35:42 GMT

Well without the global statement only the ip address's that are natted will be able to talk to the rest of the world.

If you post your config we can look it over for you. Your servers that are natted should be going out using there natted ip address's.

Patrick

Re: PIX Global IP

Fernando_Meza — Mon, 17 Apr 2006 06:02:33 GMT

there must be a mistake on your configs. The static NAT always takes precedence over your nat - global instruction. meaning that any traffic going out from your NATes servers should use its static global address and not the one been configured for PAT. please send the configs

Re: PIX Global IP

zulqurnain — Mon, 17 Apr 2006 06:30:10 GMT

Yeah I also believe that something is definately not correct here, actually i inherited this setup from the last admin, who had left without a clue.. anyways. attachment is here.

Re: PIX Global IP

Fernando_Meza — Mon, 17 Apr 2006 07:18:03 GMT

mmm.. I see what is happening here. It seems NAT policy on those static statements are causing this issue .. you should not have any problem with host 172.20.4.208 though ... nothing wrong with the configuration but it is just the way NAT works. I suggest using a one to one NAT static instead of policy NAT i.e

static (inside,outside) 213.130.119.60 172.20.4.162 netmask 255.255.255.255

You can the configure your ACL applied to the outside interface to only allow pop3 and smtp to 213.130.119.60

Re: PIX Global IP

zulqurnain — Tue, 18 Apr 2006 05:32:07 GMT

Thanks i believe i got the picture but could you be more Elaborative as what needs to be done. i dont want to do without being sure what would be the effect.

secondly, you are talking about policy NAT ????

Re: PIX Global IP

Fernando_Meza — Tue, 18 Apr 2006 05:45:18 GMT

oops sorry ..

1.- add

access-list acl_out permit tcp any host 213.130.119.60 eq pop3

2.- Remove

no static (inside,outside) tcp 213.130.119.60 pop3 172.20.4.162 pop3 netmask 255.255.255.255

no static (inside,outside) tcp 213.130.119.60 smtp 172.20.4.162 smtp netmask 255.255.255.255

clear xlate

3.- Add

static (inside,outside) 213.130.119.60 172.20.4.162 netmask 255.255.255.255

clear xlate

Test and then save the config.

NOTE: The change shoudl be transparent .. but if you are not very confident then do it after hours.

Re: PIX Global IP

joneschw1 — Tue, 18 Apr 2006 16:07:13 GMT

The clear xlate will break all current sessions, so you would see a quick outage.

Re: PIX Global IP

zulqurnain — Thu, 20 Apr 2006 03:47:55 GMT

Thanks guys, it worked

Re: PIX Global IP

Fernando_Meza — Thu, 20 Apr 2006 04:26:43 GMT

great ... don't forget to score and resolve the issue ..

Cheers,