topic Re: PIX without address translation in Network Security

PIX without address translation

pslavkovsky — Fri, 21 Feb 2020 08:18:23 GMT

Hi,

I have PIX -ver. OS is 6.3(3)- with 3 interfaces: outside, inside and dmz.

PIX will be used in intranet without address translation. IP Address must be visible from any interface to any interface, no address translation is required.

For examlpe: Users will by on interface Ouside with IP range 10.0.0.0/8, servers will be on interace Inside (192.168.1.0/24) and other devices will be on interface dmz (172.16.0.0/16).

So I created access-list:

access-list all-ip-packet permit ip any any

and use command nat 0:

nat (inside) 0 access-list all-ip-packet

nat (dmz) 0 access-list all-ip-packet

Question is:

Is it necessary to add row

nat (outside) 0 access-list all-ip-packet

or is possible to communicate from outside to inside (users to server)without this row?

Thanx

Peter

Re: PIX without address translation

nkhawaja — Sat, 30 Jul 2005 21:05:41 GMT

nat (outside) 0 is not needed.

with the other two nat () 0 statements, you are good to go

thanks

Nadeem

Re: PIX without address translation

pslavkovsky — Sun, 31 Jul 2005 04:33:17 GMT

Ok,

I tried it, it works but I do not understand why.

When packet goes from inside, PIX has this statement:

nat (inside) 0 access-list all-ip-packet

When packet goes from dmz, PIX has this statement:

nat (dmz) 0 access-list all-ip-packet

When packet goes from outside, PIX has no statement.

But It works. Can you explain it, please.

Thanks

Peter

Re: PIX without address translation

pslavkovsky — Mon, 01 Aug 2005 10:03:41 GMT

Is there anybody who understanded address translation using "nat () 0 access-list" or everybody is on holiday ???

Peter

Re: PIX without address translation

nkhawaja — Mon, 01 Aug 2005 15:17:54 GMT

see this

http://www.cisco.com/warp/public/110/19.html

Re: PIX without address translation

pslavkovsky — Tue, 02 Aug 2005 05:13:42 GMT

Thanks,

but this document does not respond my question.

Peter

Re: PIX without address translation

jeff.carr — Tue, 02 Aug 2005 17:50:34 GMT

Not sure what you are questioning, the communication or the translation. Communication between the different interfaces has more to do with the security levels than the NAT statements.

Re: PIX without address translation

pslavkovsky — Tue, 02 Aug 2005 18:12:33 GMT

One condition for working ASA is a address translation, and it must be set for case when address translation is not needed too. So It was created NAT exemption, I think.

For exapmle,

When I put access-list on outside interface "permit ip any any", I must set a address translation "nat 0 access list" if I want to communicate from outiside to inside however real address translation not doing.

My question is:

when I have

nat 0 (inside) access-list all_ip

nat 0 (dmz) access-list all_ip

access-list all_ip permit ip any any

and communication start on outside interface. Which row do not translate addreses of inbound packets?

I would wait a row

nat 0 (outside) access-list all_ip

but it is not needed. It works without this row.

Peter

Re: PIX without address translation

nkhawaja — Tue, 02 Aug 2005 20:35:00 GMT

i told you that if you just want to communicate from

inside to dmz or from dmz to inside, all you need is

nat (inside) 0 acl

static (inside,dmz) ip ip

or if you want only the communication to start from

inside and not from dmz you need

nat(inside) and global (dmz)

Remember there is not NAT (dmz) needed in either case. This is just the way it works.

now if you want to communicate from inside to outside and also from outside to inside

you need

nat (inside) 0 acl

static (inside,outside) ip ip

if u want communication from inside to outside only all you need is

nat(inside) and global (outside)

for dmz to outside communication

you need nat (dmz) 0 acl

static (dmz,outside)

or nat (dmz) and global outside

The RULE IS, you dont need translation from LOWER Security to HIGHER Security.

The exception to above rule is

-1 if you are using no nat-control feature in PIX 7.0

2- You still want to translate the outside IP adresses