PIX 501, NAT 0, Webserver on insider interface problem

[apiautobody]

I have a webserver connected to the integrated switch on the back of PIX 501 with an IP address on the same subnet as the outside interface. I want to NAT 0 the IP address so that I can have the public IP behind the firewall. I have enabled NAT 0 for the IP (Created an access list containing the IP on the inside interface and applied it to Nat 0, created a static (inside,outside) public_ip public_ip, and then I created a few conduits). I can't pass traffic in either direction. It looks to me like an ARP problem. The PC behind the firewall with the public IP can't ARP resolve the IP address of its gateway to get out to the 'net. Please advise.

[gfullage]

The PIX-501 is a layer-3 device, meaning you need different subnets on both the inside and outside interface. You can't give a machine on the inside an IP address that is on the outside subnet, IP routing in general just doesn't work that way.

The way to set it up is to use any internal network you want, usually a private subnet is chosen, say 10.1.1.0/24. Give the PIX inside interface 10.1.1.1, your web server 10.1.1.2 and assign its default gateway accordingly. Then create a static in the PIX to translate connections for the public IP over to the private as such:

static (inside,outside) 10.1.1.2 netmask 255.255.255.255

and create an ACL to allow that traffic into the web server:

access-list inbound permit tcp any host eq 80

access-list inbound permit tcp any host eq 443

access-group inbound in interface outside

[apiautobody]

I understand that the PIX is a layer three device, however, I see specific PIX configs that allow for NAT disabling. For instance, this URL http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aad.shtml#topic8 specifies what I think I want to do. I don't see the purpose for disabling NAT if you can't route through the PIX. I know that I can do this with statics, but I'd rather not have a private IP address because the control panel software I am using won't work as well. I hope this makes sense. I understand that it doesn't make IP sense, which is why I brought up the ARP thing, they are in different broadcast domains... Now I'm just rambling. Any help would be appreciated.