topic Re: What is the maximum PAT statement in PIX Firewall? in Network Security

What is the maximum PAT statement in PIX Firewall?

a.kiprawih — Fri, 21 Feb 2020 07:22:06 GMT

Hi,

What is the maximum no of PAT allowed in PIX? So far, I couldn’t find exact statement in cisco.com on this. Most of the PIX sample configuration shows 2 PATs only.

The reason was (if possible) to map each individual NAT to PAT, instead of using a pool of outside/Public IP and 1 PAT for backup. For example, 5 internal VLANs need to be mapped to 5 different PAT for easy identification and troubleshooting.

global (outside) 1 202.X.X.100

global (outside) 2 202.X.X.101

global (outside) 3 202.X.X.102

global (outside) 4 202.X.X.103

global (outside) 5 202.X.X.104

nat (inside) 1 10.100.110.0 255.255.255.0

nat (inside) 2 10.100.120.0 255.255.255.0

nat (inside) 3 10.100.130.0 255.255.255.0

nat (inside) 4 10.100.140.0 255.255.255.0

nat (inside) 5 10.100.150.0 255.255.255.0

Thanks

Re: What is the maximum PAT statement in PIX Firewall?

gfullage — Tue, 27 Apr 2004 00:32:50 GMT

There's no set limit, other than the fact the nat/global pair number can only be between 1 and 2147483647, although you'd run out of your 2Meg config size limit way before that.

I've seen configs with hundreds of them and it works fine. If you only want 5 then you'll be fine.

Re: What is the maximum PAT statement in PIX Firewall?

a.kiprawih — Tue, 27 Apr 2004 03:03:47 GMT

Hi Glen,

I did saw the max pair between 1 to 2,147,483,647, but when I tried to configure the 3rd PAT, it gives error on overlapping PAT statement. That was on a fresh installation and the public IP was free (unused)

global (outside) 1 202.X.X.100 -> ok/accepted

global (outside) 2 202.X.X.101 -> ok/accepted

global (outside) 3 202.X.X.102 -> ERROR due to overlapping PAT??

nat (inside) 1 10.100.110.0 255.255.255.0 -> ok

nat (inside) 2 10.100.120.0 255.255.255.0 -> ok

nat (inside) 3 10.100.130.0 255.255.255.0 -> ok

Did I missed any steps?

Thanks

Re: What is the maximum PAT statement in PIX Firewall?

mostiguy — Tue, 27 Apr 2004 10:09:53 GMT

what is the outside interface's ip address and subnet mask? could .102 be a broadcast address for that subnet?

Re: What is the maximum PAT statement in PIX Firewall?

a.kiprawih — Tue, 27 Apr 2004 23:17:37 GMT

The public IP subnet is 202.X.X.96/27. Usable address range should be 202.X.X.97 - 202.X.X.126, broadcast is 202.X.X.127.

Thanks