topic Re: How you call this type STATIC ? in Network Security

How you call this type STATIC ?

amarula115 — Mon, 11 Mar 2019 13:51:35 GMT

How you call properly this type of STATIC:

static (inside,outside) 172.16.32.0 172.16.32.0 netmask 255.255.255.0

and what is the purpose of such STATIC?

Re: How you call this type STATIC ?

Jon Marshall — Wed, 01 Oct 2008 11:12:20 GMT

It is static because the translation is not dynamically created when traffic goes through the firewall. This a permanent translation that you want all the time.

The purpose is because of an oddity with the pix/asa device. To allow traffic from a lower to a higher security level interface you need to

i) allow it in an access-list

ii) have a NAT statement for it

On most other firewalls you only NAT if you want to represent one address as another address. On pix/asa even if you don't want to change the address because of ii) you must have a nat statement and that is why you have it. It is almost a way of saying to the pix/asa i don't want to NAT for 172.16.32.0.

As i say it is an oddity of the pix/asa firewalls.

Jon

Re: How you call this type STATIC ?

cisco24x7 — Wed, 01 Oct 2008 14:00:44 GMT

you either use static (i,o) same-ip same-ip

or nat(inside) 0 access-list with Pix version

6.3(x).

With version 7.x, you do not have to do this

if you have "no nat-control". That will

allow traffic from high to low.

HOWEVER, AS SOON AS YOU HAVE nat (inside) 1 x x

and global (outside) 1 interface, "NO NAT-CONTROL" WILL BECOME USELESS FOR

INTERFACE "INSIDE"

Re: How you call this type STATIC ?

amarula115 — Wed, 01 Oct 2008 18:07:15 GMT

Thank you

Re: How you call this type STATIC ?

amarula115 — Wed, 01 Oct 2008 18:07:35 GMT

thank you