topic Re: PIX NAT problems in Network Security

PIX NAT problems

smatting — Fri, 21 Feb 2020 07:02:52 GMT

I'm using a global NAT pool that spans 5 Class C subnets and I am NAT'ing all internal hosts to that pool. Strange behavior is that I am running out of translations, it stops handing out translations when it reaches somewhere in the area of 650 translations.

Here's my nat config:

global (outside) 1 152.157.168.1-152.157.172.254

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

What's really strange is that certain addresses are skipped as translations are handed out. It seems to be following a pattern of handing out addresses: 1,2,5,9

Any ideas?

Re: PIX NAT problems

jmia — Thu, 16 Oct 2003 16:31:56 GMT

Scott -

Have you tried command: clear xlate, and see if you get the same problem. Also which pix ios and pix model, i.e. 501/506/515 etc.

Thanks -

Re: PIX NAT problems

nkhawaja — Thu, 16 Oct 2003 17:46:33 GMT

HI,

CAn you see how many translations are being built up.

"show xlat count"

What if some inside PC's are infected with virus/worm and sending spoofed IP packets towards/across PIX, Hence PIX is making translation for them.

try "show xlat" and find out if any IP other then your inside network is making the entry there.

Additionaly you can try the following

1- Make access-list on the inside interface to only permit your inside network to go through the PIX

2- change the nat(inside) 1 0.0.0.0 0.0.0.0 to

nat (inside) 1

3- apply "ip verfiy reverspath inside" command

4- make a PAT entry e.g. global(outside) 1 interface

Thanks

Nadeem