Access to multiple networks behind PIX without static nat

[tuvanh]

I have 3 internal networks on pix inside interface, to access from outside or dmz to my internal servers I have to create static nat for all these networks on dmz, outside interface, and other interfaces(if i want to reach my server from that interface). Does this consume much memory ? Do you have any better configurations ?

What's outside nat for ?

[shannong]

You can write static statements to cover entire NAT blocks. For example, this static NATs and entire internal network back to itself:

static (inside,dmz) 192.168.10.0 192.168.10.0 netmask 255.255.255.0

This one would NAT an internal network into another block, but the last octet would remain the same for the NATted sessions:

static (inside,outside) 30.15.20.0 192.168.10.0 netmask 255.255.255.0

So 192.168.10.25 would be NATted to 30.15.20.25, and so on....

You can also use NAT 0 so that NAT isn't performed on the IPs. Beware that this has the negative side effect of the translation not being available for access on the lower security interface until the host initiates a session going out first. Don't forget that inactive translations timeout.

-Shannon