NAT / Routing on PIX 515

[kdagostino]

I have a 2620 connected to 2 ISPs on the outside of my pix - i have 10 users that must be static NAT to point to one ISP and the rest will be NAT from a pool pointing to the other ISP. I would like to keep the outside interface of the PIX a private IP. I am leaning towards creating a route-map with ACL to direct the traffic accordingly.

Should I NAT on the PIX or router or both?

[gfullage]

Hmm, difficult to say, you could do it on either, and it's probably much of a muchness which way you end up doing it. I'd probably do it on the router since you have a private IP address on the PIX. On the router you'd just do (assuming your inside network is 10.1.1.0/24):

ip nat inside source static 10.1.1.1 200.1.1.1

.......

ip nat inside source static 10.1.1.10 200.1.1.10

ip nat pool ippool 150.1.1.1 150.1.1.254 prefix-length 24

ip nat inside source list 100 pool ippool overload

access-list 100 permit ip 10.1.1.0 0.0.0.255 any

and then on the PIX just do:

static (inside,outside) 10.1.1.0 10.1.1.0 netmask 255.255.255.0

[kdagostino]

Thanks for the reply, but what is the need for the static on the PIX?