topic Re: Basic NAT-PAT configuration question in Network Security

Basic NAT-PAT configuration question

DAVMAC111 — Mon, 11 Mar 2019 10:19:01 GMT

I want to configure a PIX 501 firewall for NAT - or more accurately PAT.

I want all inside users to be able to access the Internet using their non-routable IP adresses that the PIX will translate at the perimeter.

I only have one public IP address available.

I do not have a range as shown in the example below from:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v52/config/examples.htm#xtocid2

Start of example

nat (inside) 1 0 0

global (outside) 1 209.165.201.10-209.165.201.30

global (outside) 1 209.165.201.8

"Create a pool of global addresses that translated addresses use when they exit the firewall from the protected networks to the unprotected networks. The global command statement is associated with a nat command statement by the NAT ID, which in this example is 1. Because there are limited IP addresses in the pool, a PAT (Port Address Translation) global is added to handle overflow."

End of example

So, in my case, can I simply use the second global line to attain my objective?

Also, do I need to configure particular access-list entries in this case or will the PIX take care of everything automatically?

Thank you,

David

Re: Basic NAT-PAT configuration question

srue — Wed, 23 May 2007 16:33:08 GMT

best practice is the following:

nat (inside) 1 0 0

global (outside) 1 interface

you literally use the keyword 'interface' in the global command. it will use the outside interface IP, no matter what it is. you could also just use the outside IP there though. both accomplish NAT overloading / PAT.

Re: Basic NAT-PAT configuration question

DAVMAC111 — Thu, 24 May 2007 12:21:17 GMT

Thanks for the answer!

Does the result look right (I'm going to test it now)?

pixfw(config)# nat (inside) 1 0 0

pixfw(config)# show nat

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

pixfw(config)# global (outside) 1 interface

outside interface address added to PAT pool

pixfw(config)# show global

global (outside) 1 interface