topic PIX - PATing or not depending on outside interface used in Network Security

PIX - PATing or not depending on outside interface used

sheidelbach — Fri, 21 Feb 2020 07:38:34 GMT

I'm still digging into this, but have a need to not NAT any traffic starting on the inside to 2 of my lower-security interfaces (dmz1 & dmz2), but have that same traffic PATed to the interface address if it goes out outside interface.

I'm using nat (inside) 0 0.0.0.0 0.0.0.0 for the non-nating of traffic that goes from inside to dmz1 & dmz2. So, this keeps me from putting in another nat statement [like nat (inside) 1 0.0.0.0 0.0.0.0)] as that causes an error message saying the nat statements overlap. Makes a certain amount of sense.

It looks like a "static (inside,outside) interface 10.1.1.0 netmask 255.255.255.0" would be the perfect solution. But I get a "Invalid netmask with interface option" error message when I try to input that. So, that must not be able to do groups of addresses. It also only lets me do a single static to the interface address, so that is not going to fly even if I was willing to type in every host individually.

I was hoping that static command would let me overload all the inside addresses to the outside interface address when data is going out the "outside" interface, while the "nat (inside) 0" lets me non NAT anything going to dmz1 & dmz2, but no dice.

Any thoughts on what I'm missing here? There has got a be a way to do this.

Thanks!

Re: PIX - PATing or not depending on outside interface used

jzsides — Tue, 21 Sep 2004 17:31:37 GMT

Have you tried this?

Let's say you have:

192.168.0.0/24 on inside

192.168.1.0/24 on DMZ1

192.168.2.0/24 on DMZ2

access-list NoNATinside permit ip 192.168.0.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list NoNATinside permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0

nat (inside) 0 access-list NoNATinside

nat (inside) 1 192.168.0.0 255.255.255.0

global (outside) 1 interface

Re: PIX - PATing or not depending on outside interface used

sheidelbach — Tue, 21 Sep 2004 18:59:05 GMT

Way cool! Did not notice an ACL as being an option for NAT commands.

Waaaaay cool!

Thanks!