Has anyone successfully used this? I had an idea to use it, in combination with global (inside) interface and a static statement to allow a router outside a firewall to pass RIPv2 md5 updates using neighbor statements to routers on the inside of the firewall. Essentially the neighbor becomes the outside address defined in the static statement, and the inside address in the static statement is the address of the inside router interface. That takes care of the destination address of the unicast RIP packet. However, the inside router ignores it because the source address is still the real outside router address (not ont he same subnet).
So I installed
nat (outside) 2 <outside router address and mask> outside
global (inside) 2 interface
This worked exactly as I had hoped, and translated the source address of the outside router's RIP updates to the inside interface of the PIX. The inside router then installs the routes in its table using the inside address of the PIX as the nexthop. Debugs and packet traces confirm behavior. So far so good.
However, in doing the above, nat (inside) appears to break. I have a generic nat (inside) config, like:
nat (inside) 1 0 0
global (outside) 1 interface
Without the nat (outside) command, I can ping and make normal connections outbound. When the nat (outside) command is installed, pings and connection attempts don't make it outbound through the firewall anymore. Debug packet inside on the firewall confirms the packets are arriving at the inbound interface, but debug ip packet on the outside router confirms the packets are not making it through the PIX.
Does anyone have a working configuration for this, where nat works in both directions? Thanks.
