GSS Behind firewall

[cisco123456]

I am looking to deploy GSS devices at two different locations. While reading the GSS configuration guide I noticed that deployment behind NAT devices is not supported. Quote 'The GSS does not support deployment of devices behind a NAT for inter-GSS communication. The communication between GSSs cannont inlcude an intermediate device behind a NAT because the actual IP address of the devices is ebedded in the payload of the packets.' Since our PIX firewalls perform NAT, I am assuming the GSSs have to be outside the firewalls. Is this a correct assumption? What is the recommended deployment strategy for this product?

[Gilles Dufour · Accepted solution]

you could still place the GSS behind the firewall but inside a DMZ where you don't perform any natting.

Like this, you still have the protection from the firewall.

Gilles.