Hi,
The parameter "outside" after the "nat" command should to my understanding be only needed when the destinaton interface (the one holding the "global" command ) is of lower "security-level" than the source interface (the one holding the "nat" command)
Are we talking about a new setup which you are trying to get working or an existing setup for which you are configuring a new Dynamic PAT that doesnt seem to work or get applied?
Naturally the annoying thing with this is the FWSM. Mainly because "packet-tracer" can not be used with it
Have you enabled ICMP Inspection for the FWSM so that the reply/return messages/replies for ICMP can pass the firewall? I think since you are doing PAT that you will need ICMP inspection for this.
You should be able to view the current Inspection configurations with the following command
show run policy-map
If you have the default policy configurations attached globally you could add the following lines
inspect icmp
inspect icmp error
I am not sure if we should look for any problems with the NAT configurations (some other configuration than the above that would cause problems) .
- Jouni
