topic Multiple PIX Statics in Network Security

Multiple PIX Statics

marcus.nutting — Fri, 21 Feb 2020 07:57:54 GMT

Hi all,

Does the PIX 'static' command use a shortest-match-first rule, in a similar way to route table lookups?

For example is this a valid configurattion for two-way static:

----------------SNIP-------------------

static (DMZ,outside) 10.11.1.0 10.11.1.0 netmask 255.255.255.0 0 0

static (inside,outside) 10.11.0.0 10.11.0.0 netmask 255.255.0.0 0 0

----------------SNIP-------------------

Where 10.11.1.0/24 is the DMZ network?

Thanks,

Re: Multiple PIX Statics

sachin — Tue, 15 Feb 2005 14:21:35 GMT

With PIX version 6.2 , PIX doesnot go with best match rule like route table lookup, it does like which ever comes first So if u want to match a specific entry then put it above the less specific entry.As you have that entry in above example so all 10.11.1.0 will be matched first.

But suppose if you put like this --

static (inside,outside) 10.11.0.0 10.11.0.0 netmask 255.255.0.0 0 0

static (DMZ,outside) 10.11.1.0 10.11.1.0 netmask 255.255.255.0 0 0

Then it will get matched with first one always.

HTH.

Regards,

Sachin Jain

Re: Multiple PIX Statics

marcus.nutting — Tue, 15 Feb 2005 15:42:53 GMT

Hi thanks for the reply,

Is that the same for FWSM 2.3(1)?

Also, how do I insert statics above existing statics in a production config?

I don't want to rremove the existing line:

---------------

static (inside,outside) 10.11.0.0 10.11.0.0 netmask 255.255.0.0 0 0

---------------

Regards,

Re: Multiple PIX Statics

scoclayton — Tue, 15 Feb 2005 15:59:53 GMT

Yes, the same rule applies to both PIX software as well as FWSM software. First match in the list wins with static statements.

Unfortunately, there is no way to add static statements higher in the list without re-applying them in the order you want. The existing translations are not cleared by removing the statics statements. You would need to issue a 'clear xlate' to clear the existing translations.

Scott

Re: Multiple PIX Statics

scoclayton — Tue, 15 Feb 2005 16:00:21 GMT

Yes, the same rule applies to both PIX software as well as FWSM software. First match in the list wins with static statements.

Scott

Re: Multiple PIX Statics

sachin — Wed, 16 Feb 2005 08:53:10 GMT

Please give ratings It will help others also.