topic PIX Multiple "NAT Subnets" per interface ? in Network Security

PIX Multiple "NAT Subnets" per interface ?

PIXMayhem — Mon, 11 Mar 2019 12:18:35 GMT

Not entirely sure how to explain this so here goes.

Is it possible to use NAT/global or static statements for subnets not physically connected to the PIX ?

Problem is we have run out of address space on our external interface and want to add a static nat for new device using another subnet address.

Existing config eg:

static (inside,outside) 172.16.253.250 10.128.1.10 netmask 255.255.255.255 0 0

(Where 172.16.253.250 is part of physicall connected subnet.)

Required new NAT:

static (inside,outside) 172.16.252.249 10.128.1.13 netmask 255.255.255.25 5 0 0

(where 172.16.252.249 is not part of the physically connected subnet)

This is something we use frequently on our other firewalls but the first time we have tried on PIX. Is it possible ? If so How ?

Re: PIX Multiple "NAT Subnets" per interface ?

Jon Marshall — Mon, 17 Mar 2008 13:29:48 GMT

Yes it is entirely possible and you would do it as you have done with your static statements. What you have to ensure is that any traffic for the subnet 172.16.252.x ie. the one not connected physcially, gets routed to the outside interface of your pix.

HTH

Jon

Re: PIX Multiple "NAT Subnets" per interface ?

abinjola — Mon, 17 Mar 2008 13:52:10 GMT

yes this is possible

Upstream router----(out)Pix(in)----inside

out =172.16.253.250/24

Now for your required static to work you need to add a route on the upstream router that points 172.16.252.249 to firewall outside interface address

ip route 172.16.252.249 255.255.255.0

let me know once it works !

Re: PIX Multiple "NAT Subnets" per interface ?

PIXMayhem — Mon, 17 Mar 2008 18:03:12 GMT

Well I thought it should be possible. Am I right in thinking the static applies in both directions, i.e. connections made from the inside device (10.128.1.13) should appear to the outside world as 172.16.252.249.

Currently I'm not seeing a thing on the outside interface so tomorrow I need to get a sniffer on the job.

Re: PIX Multiple "NAT Subnets" per interface ?

abinjola — Mon, 17 Mar 2008 18:55:38 GMT

ping anything on outside from the host 10.128.1.13 and turn on debug icmp trace on the firewall