topic Re: Access from lower to higher security interface (PIX 520 Vers in Network Security https://community.cisco.com/t5/network-security/access-from-lower-to-higher-security-interface-pix-520-version-6/m-p/52501#M685386 <HTML><HEAD></HEAD><BODY><P>I don't think that nat 0 is apropriate here, but you can use a subnet mask when setting up your static. This should simplify your configuration somewhat. Similarly, your access-lists can be setup to use a subnet mask (instead of individual hosts).</P><P></P><P>I think this is the way to do it -- some please correct me if I'm wrong!</P></BODY></HTML> Tue, 30 Apr 2002 13:46:31 GMT mklaphek 2002-04-30T13:46:31Z Access from lower to higher security interface (PIX 520 Version 6) https://community.cisco.com/t5/network-security/access-from-lower-to-higher-security-interface-pix-520-version-6/m-p/52500#M685381 <P>I'm trying to permit traffic from a lower security interface (i.e. DMZ) to a higher security interface (i.e. Inside). I want Servers on the DMZ to connect to Servers on the inside network using the inside Servers IP address, not a NAT'd one.I can do this by creating a static rule, mapping &lt;inside Server IP address&gt; to &lt;inside Server IP address&gt;, and creating associated access-lists. However I do not want to have to create a static for every Server I'm likely to want to access on the inside network.I need to find the answers to the following;Qu.1: It's been suggested to me to use a NAT 0. Does this only apply to traffic going from a higher to lower security interface, not the other way round ?Qu.2: Is the only way to go from a lower security interface to a higher one is via the static command ?</P> Fri, 21 Feb 2020 06:02:39 GMT https://community.cisco.com/t5/network-security/access-from-lower-to-higher-security-interface-pix-520-version-6/m-p/52500#M685381 gmdavies 2020-02-21T06:02:39Z Re: Access from lower to higher security interface (PIX 520 Vers https://community.cisco.com/t5/network-security/access-from-lower-to-higher-security-interface-pix-520-version-6/m-p/52501#M685386 <HTML><HEAD></HEAD><BODY><P>I don't think that nat 0 is apropriate here, but you can use a subnet mask when setting up your static. This should simplify your configuration somewhat. Similarly, your access-lists can be setup to use a subnet mask (instead of individual hosts).</P><P></P><P>I think this is the way to do it -- some please correct me if I'm wrong!</P></BODY></HTML> Tue, 30 Apr 2002 13:46:31 GMT https://community.cisco.com/t5/network-security/access-from-lower-to-higher-security-interface-pix-520-version-6/m-p/52501#M685386 mklaphek 2002-04-30T13:46:31Z