Can we have a single NAT'ed IP address for inbound and outbound access?

[pmoy]

I have a very simple question regarding inbound/outbound connections.

My PIX is a Cisco 525 running v6.3 software.

We have a MS clustered server that provides 3 IP addresses.

1. Virtual IP address for inbound TCP connections (FTP for example) to the cluster.

2. This cluster also initiates outbound TCP connections. But when the

outbound is connection is generated, the source IP address will be that of one of the physical boxes (A or B)

So we have a problem. We want to provide all our customers on the outside of the PIX with one IP address for all connections.

Inbound connections are no problem, I'll create a static/access-list

mapping with the virtual cluster address

static (inside,outside) 204.124.119.46 192.168.1.46

access-list acl_customer permit tcp 167.80.159.0 255.255.255.0 host

204.124.119.46 eq 7828

The clustering software will handle directing the inbound traffic on port 7828 to the correct server.

Now the cluster comes into play for outbound connections, I'll need to

NAT both real IP addresses behind one address on the outside

nat (inside) 1 192.168.1.46 255.255.255.252

! This will hide both 192.168.1.46 & 47 addresses

global (outside) 1 204.124.119.46 netmask 255.255.255.255

Is it even possible to have a single IP address on the outside that is created

by both a static and nat/global command?

The goal is to show the world a single IP address for both inbound and outbound

connections.

Thanks,

-Pete

[Fernando_Meza]

You could try using Port redirection on the incoming traffic

static (inside,outside) tcp 204.124.119.46 7828 192.168.1.46 7828 netmask 255.255.255.255

and nat/global for traffic initiated internally

nat (inside) 1 access-list 100

global (outside) 1 204.124.119.46 netmask 255.255.255.255

access-list 100 permit ip host 192.168.119.46 any

access-list 100 permit ip host 192.168.119.47 any

[pmoy]

Thanks Fernando,

We did look at this, but unfortunately it'll mean having to modify hundreds of ACL's we already have in place.

We're going to try a workaround by creating one outside IP address for ourbound access with a global/NAT and using another address for inbound (stat/ACL) access instead of trying to use one address.

-Pete

[Fernando_Meza]

yes .. it is probably the best option