topic Re: PIX Static Translation in Network Security

PIX Static Translation

b.joanis — Fri, 21 Feb 2020 07:11:15 GMT

Just a quick question I though I would put out on the table. I have a Pix 515, with a total of four DMZ's. I had to configure STATic mappings across DMZ's for certian servers. Here is my question. There are three types of Static Translations:

Note High and low refer to security levels.

1. static (high,low)low high

2. static (high,low) high high

3. ????

What is the third static confgiuration and what would it be used for.

Thanks in advance

Re: PIX Static Translation

nkhawaja — Sat, 10 Jan 2004 03:08:57 GMT

Hi,

3rd is

static (low,high) high low

this is called Destination NAT.

Thanks

Nadeem

Re: PIX Static Translation

b.joanis — Mon, 12 Jan 2004 15:35:19 GMT

Thanks

Re: PIX Static Translation

t.moxon — Thu, 15 Jan 2004 19:32:21 GMT

Nadeem, Can you elaborate on this? How and why would this destination NAT static be used? I have seen this in a config but couldn't figure what they were trying to accomplish.

Re: PIX Static Translation

scoclayton — Thu, 15 Jan 2004 21:06:20 GMT

Easy example here is a 3 interface PIX. Let's say you have a webserver on the DMZ interface of the PIX and you want your internal users to be able to access this server via the global address rather than the address configured locally on the box itself. This is fairly common when the DNS reply for the webserver name is a global address. So, in a case like this, you could solve this problem by entering:

static (dmz,inside) 2.2.2.2 10.1.1.1 netmask 255.255.255.255

In this case, the PIX would translate the DESTINATION address from 2.2.2.2 on the inside interface to 10.1.1.1 and place the packet on the DMZ interface. Does this help?

Scott

Re: PIX Static Translation

b.joanis — Fri, 16 Jan 2004 12:54:53 GMT

Gents,

Makes sense. This will come in handy with some of the web projects I have going on now. Any chance anyone can send a web link to Cisco's documentation on this static command.

Thanks,

Brian

Re: PIX Static Translation

scoclayton — Fri, 16 Jan 2004 14:47:38 GMT

Such as this?

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/s.htm#1026694

Glad we could help.

Scott