Internet adsl modem ---> Cisco 515e V7 ----> Server (dns-web-mysql-mail)

[stewartrose]

Good Morning Team,

Is it possible to confgire Pix to have the real address going into pix and real address comming out without having nat translation, I have 5 static ips out of my adsl modem, if the answer is yes do you have a sample config file please..

All the best from Alan

[Marwan ALshawi]

first if u gonna configure it like this u will lose IPs fo interface and so on

just put one of those IPs on the dsl setup for the outide or dialer interface

an others make them through static nat

easy

ststic (inside, outside) [public ip] [rivate ip] netmask 255.255.255.255

do the above for each ip

and mak an acl permit traffic from any distened to the public ip address either any port or for secific port

then apply it inbound on the outside interface

thats it

good luck

please, if helpful rate

[stewartrose]

Hi Support do you mean this..

hostname fw84

domain-name askmema.com

nameif ethernet0 outside security0

nameif ethernet1 inside security100

interface ethernet0 100full

interface ethernet1 100full

ip address outside 82.70.83.81 255.255.255.248

ip address inside 82.70.83.82 255.255.255.248

route outside 0.0.0.0 0.0.0.0 82.70.83.86 1

nat (inside) 1 82.70.83.82 255.255.255.248 0 0

global (outside) 1 interface

static (inside,outside) 82.70.83.83 82.70.83.82 netmask 255.255.255.255 0 0

static (inside,outside) 82.70.83.84 82.70.83.82 netmask 255.255.255.255 0 0

static (inside,outside) 82.70.83.85 82.70.83.82 netmask 255.255.255.255 0 0

access-list servergrp permit tcp any host 82.70.83.82 eq ssh

access-list servergrp permit tcp any host 82.70.83.82 eq ftp

access-list servergrp permit tcp any host 82.70.83.82 eq smtp

access-list servergrp permit tcp any host 82.70.83.82 eq http

access-list servergrp permit tcp any host 82.70.83.82 eq https

access-list servergrp permit icmp any host 82.70.83.82 echo-reply

access-group servergrp in interface outside

access-group servergrp in interface inside

All the best from Alan

[Marwan ALshawi · Accepted solution]

i meant

lets say u have three server on the inside

first the inside ip will be for eample

192.168.1.1 /24

server 192.168.1.10

server2 192.168.1.20

server3 192.168.1.30

and u have the above address u want each one to be mapped

based on ur config u need to do the folloiwnf

nat (inside) 1 192.168.1.0

global (outisde) 1 interface

static (inside,outside) 82.70.83.83 192.168.1.10 netmask 255.255.255.255 0 0

static (inside,outside) 82.70.83.84 192.168.1.20 netmask 255.255.255.255 0 0

static (inside,outside) 82.70.83.85 192.168.1.30 netmask 255.255.255.255 0 0

and change the inside ip addrees

this will make static ip to ip maping (nating)

and keep ur ACLs as u want to permit what u want

good luck

please if helpful rate