Multiple PIX Statics

[marcus.nutting]

Hi all,

Does the PIX 'static' command use a shortest-match-first rule, in a similar way to route table lookups?

For example is this a valid configurattion for two-way static:

----------------SNIP-------------------

static (DMZ,outside) 10.11.1.0 10.11.1.0 netmask 255.255.255.0 0 0

static (inside,outside) 10.11.0.0 10.11.0.0 netmask 255.255.0.0 0 0

----------------SNIP-------------------

Where 10.11.1.0/24 is the DMZ network?

Thanks,

[sachin]

With PIX version 6.2 , PIX doesnot go with best match rule like route table lookup, it does like which ever comes first So if u want to match a specific entry then put it above the less specific entry.As you have that entry in above example so all 10.11.1.0 will be matched first.

But suppose if you put like this --

static (inside,outside) 10.11.0.0 10.11.0.0 netmask 255.255.0.0 0 0

static (DMZ,outside) 10.11.1.0 10.11.1.0 netmask 255.255.255.0 0 0

Then it will get matched with first one always.

HTH.

Regards,

Sachin Jain

[marcus.nutting]

Hi thanks for the reply,

Is that the same for FWSM 2.3(1)?

Also, how do I insert statics above existing statics in a production config?

I don't want to rremove the existing line:

---------------

static (inside,outside) 10.11.0.0 10.11.0.0 netmask 255.255.0.0 0 0

---------------

Regards,

[scoclayton]

Yes, the same rule applies to both PIX software as well as FWSM software. First match in the list wins with static statements.

Unfortunately, there is no way to add static statements higher in the list without re-applying them in the order you want. The existing translations are not cleared by removing the statics statements. You would need to issue a 'clear xlate' to clear the existing translations.

Scott

[scoclayton]

Yes, the same rule applies to both PIX software as well as FWSM software. First match in the list wins with static statements.

Unfortunately, there is no way to add static statements higher in the list without re-applying them in the order you want. The existing translations are not cleared by removing the statics statements. You would need to issue a 'clear xlate' to clear the existing translations.

Scott

[sachin]

Please give ratings It will help others also.