Access to multiple networks behind PIX without static nat

tuvanh — Fri, 21 Feb 2020 06:37:55 GMT

I have 3 internal networks on pix inside interface, to access from outside or dmz to my internal servers I have to create static nat for all these networks on dmz, outside interface, and other interfaces(if i want to reach my server from that interface). Does this consume much memory ? Do you have any better configurations ?

What's outside nat for ?

Re: Access to multiple networks behind PIX without static nat

shannong — Wed, 19 Mar 2003 13:57:35 GMT

You can write static statements to cover entire NAT blocks. For example, this static NATs and entire internal network back to itself:

static (inside,dmz) 192.168.10.0 192.168.10.0 netmask 255.255.255.0

This one would NAT an internal network into another block, but the last octet would remain the same for the NATted sessions:

static (inside,outside) 30.15.20.0 192.168.10.0 netmask 255.255.255.0

So 192.168.10.25 would be NATted to 30.15.20.25, and so on....

You can also use NAT 0 so that NAT isn't performed on the IPs. Beware that this has the negative side effect of the translation not being available for access on the lower security interface until the host initiates a session going out first. Don't forget that inactive translations timeout.

-Shannon

topic Re: Access to multiple networks behind PIX without static nat in Network Security

Access to multiple networks behind PIX without static nat

Re: Access to multiple networks behind PIX without static nat