topic Re: Best way to config a PIX without NAT in Network Security

Best way to config a PIX without NAT

tkpsimon — Fri, 21 Feb 2020 06:59:07 GMT

I have tried, "NAT (inside) 0 x.x.x.x 255.255.255.0"

it's working, but some how outside host cannot access anything behind the pix unless the inside machine start a session to outside first.

Any idea why this happen? is this normal?

any idea would be appreciate.

Re: Best way to config a PIX without NAT

mostiguy — Wed, 10 Sep 2003 15:36:15 GMT

That is normal - you need to write an access list to open ports, and apply it to the outside interface

Re: Best way to config a PIX without NAT

tkpsimon — Wed, 10 Sep 2003 15:42:14 GMT

Thanks for your reply,

actually i already have ACL apply on the outside interface, let set permit icmp any any. But problem still happen to be that way, always require inside host to initial traffic, then outside can access.

I understand this is not a big of issue, but for web server, it's kind of annoying. We always need to send out icmp to outside.

Re: Best way to config a PIX without NAT

r.sneekes — Thu, 18 Sep 2003 14:39:22 GMT

You need to a nat 0 rule with an access-list for this to work.

For example:

nat 0 (inside) access-list no-nat

access-list no-nat permit ip 10.10.0.0 255.255.0.0

Re: Best way to config a PIX without NAT

atdhingr — Fri, 19 Sep 2003 10:41:44 GMT

you need a static and an ACL for outside users to initiate a connection inside:

static(inside,outside)

access-list 101 permit ip any

access-group 101 in interface outside