PIX 515E 6.3(3) Without NAT or PAT

[schelec]

Hello

I have the following Configuration:

Inside interface: 10.55.28.254 255.255.255.0 (Subnet 10.55.28.0)

Outside interface: 193.222.100.5 255.255.255.0 (Subnet 193.222.100.0)

The route outside 0.0.0.0 0.0.0.0 193.222.100.26 1 is set to my router.

The required routes at my router are set.

Now my question:

If i try the command 'nat (inside) 0 193.222.100.5 255.255.255.0' as described in the sample configuration, step 10, the following error is generated: WARNING: IP adress <193.222.100.3> and netmask <255.255.255.0> are inconsistent nat 0 193.222.100.0 will be identity translated for outbound.

Which commands are required for my configuration?

Thanks

Felix

[jagb]

I think that the warning you receive is because the nat 0 range specified in your statement does not fall on a subnet boundary. On the assumption that you want to allow traffic out from the entire class C 193.222.100.0 network untranslated, you should use the command:

nat (inside) 0 193.222.100.0 255.255.255.0

This should not produce the warning above.

[ehirsel]

Is your goal to have the 10.55.28/24 hosts appear on the outside with their inside ip address? If so, you should code nat (inside) 0 10.55.28.0 255.255.255.0

[schelec]

Thats right. I need the 10.55.28/24 hosts untranslated at the outside. If the above code is the solution, then the documentation - or at least the samples - seem to be not correct. They point to the outside address. Its a little bit confusing...

Thanks!

[ehirsel]

The doc is confusing. The way config my firewalls is not to do identity nat (nat (intf) 0 ip mask) but rather do this: nat (inside) 0 access-list acl-xxxx

to not translate the inside addresses.

How about trying this:

access-list acl_inside_nonat permit ip 10.55.28.0 255.255.0.0 193.222.100.0 255.255.255.0

and then coding nat (inside) 0 access-list acl_inside_nonat

and removing the nat (inside) 0 193.222.100.0 255.255.255.0

Then do a clear xlate. Note you should do the clear xlate even if you change to nat (inside) 0 10.55.28.0 255.255.255.0

This ought to work, and the examples on cisco are much more clear on the access-list or exception nat.

Let me know how it goes.

[schelec]

Great - it works! Thank you very much!

The only little problem is now, that the PDM 3.0 tells me, that there ist no translation rule for any host or network, if i add a access rule via this tool. What can we do here?

Thanks