What is the maximum PAT statement in PIX Firewall?

[a.kiprawih]

Hi,

What is the maximum no of PAT allowed in PIX? So far, I couldn’t find exact statement in cisco.com on this. Most of the PIX sample configuration shows 2 PATs only.

The reason was (if possible) to map each individual NAT to PAT, instead of using a pool of outside/Public IP and 1 PAT for backup. For example, 5 internal VLANs need to be mapped to 5 different PAT for easy identification and troubleshooting.

global (outside) 1 202.X.X.100

global (outside) 2 202.X.X.101

global (outside) 3 202.X.X.102

global (outside) 4 202.X.X.103

global (outside) 5 202.X.X.104

nat (inside) 1 10.100.110.0 255.255.255.0

nat (inside) 2 10.100.120.0 255.255.255.0

nat (inside) 3 10.100.130.0 255.255.255.0

nat (inside) 4 10.100.140.0 255.255.255.0

nat (inside) 5 10.100.150.0 255.255.255.0

Thanks

AK

[gfullage]

There's no set limit, other than the fact the nat/global pair number can only be between 1 and 2147483647, although you'd run out of your 2Meg config size limit way before that.

I've seen configs with hundreds of them and it works fine. If you only want 5 then you'll be fine.

[a.kiprawih]

Hi Glen,

I did saw the max pair between 1 to 2,147,483,647, but when I tried to configure the 3rd PAT, it gives error on overlapping PAT statement. That was on a fresh installation and the public IP was free (unused)

global (outside) 1 202.X.X.100 -> ok/accepted

global (outside) 2 202.X.X.101 -> ok/accepted

global (outside) 3 202.X.X.102 -> ERROR due to overlapping PAT??

nat (inside) 1 10.100.110.0 255.255.255.0 -> ok

nat (inside) 2 10.100.120.0 255.255.255.0 -> ok

nat (inside) 3 10.100.130.0 255.255.255.0 -> ok

Did I missed any steps?

Thanks

AK

[mostiguy]

what is the outside interface's ip address and subnet mask? could .102 be a broadcast address for that subnet?

[a.kiprawih]

The public IP subnet is 202.X.X.96/27. Usable address range should be 202.X.X.97 - 202.X.X.126, broadcast is 202.X.X.127.

Thanks