Hi!
I have simple test network with overlapping address spaces and want to solve the problem with PIX NAT on a single PIX firewall.
PIX inside = 192.168.1.0/24
PIX outside = 172.16.1.0/24
and the config is:
route outside 0.0.0.0 0.0.0.0 172.16.1.2 1
nat (inside) 1 0.0.0.0 0.0.0.0
global (outside) 1 interface
static (inside,outside) 172.16.1.10 192.168.1.4 netmask 255.255.255.255
static (outside,inside) 192.168.2.0 192.168.1.0 dns netmask 255.255.255.0
The overlapping network 192.168.1.0/24 is behind a router 172.16.1.2.
When I'm trying to connect to static address 172.16.1.10 from the outside overlapping network I see:
Built inbound TCP connection 43 for outside:192.168.1.112/11010 (192.168.2.112/11010) to inside:192.168.1.4/23 (172.16.1.10/23)
And:
No route to 192.168.1.112 from 172.16.1.10
This means that the problem is with the traffic returning from the inside host 192.168.1.4 (172.16.1.10).
Adding the route: "route outside 192.168.1.112 255.255.255.255 172.16.1.2" allows me to connect, but it obviously doesn't solve the general problem.
Adding the route "route outside 192.168.1.0 255.255.255.128 172.16.1.2" (as suggested by the PIX documentation) leads to "No route to 192.168.1.4 from 192.168.2.112" !!!
IS THIS A JOKE OF PIX DEVELOPERS???
It seems that the PIX is ALWAYS doing NAT before ROUTING, regardless of the direction of the traffic flow! THIS IS A WRONG IDEA.
The question is: is the PIX "solution" for overlapping networks really so broken?
Any comments are greatly appreciated.
Oleg Tipisov,
CCSI,
Redcenter,
Moscow
