Co-existaece of NAT and NAT-Bypass in PIX515E

[abipu]

Hi, I want my PIX to be configured to support NAT for inside network and NAT Bypass for both dmz1 and dmz2. IOS Ver is 6.3. I need immediate feedback if this is possible at all and how?

[mostiguy]

Sure. Nat everything from the inside out, but have a nat 0 access list for the inside to exclude traffic from it to both dmzs, for purpose of NATing.

[abipu]

Thanks. Could you please explore exactly how to do that? A sample configuration is much preferable.

[johansens]

like this:

global (outside) 1 interface

nat (inside) 0 access-list no.nat.from.inside

nat (inside) 1 0.0.0.0 0.0.0.0

access-list no.nat.from.inside extended permit any a.b.c.d 255.255.255.0

access-list no.nat.from.inside extended permit any e.f.g.h 255.255.255.0

Where a.b.c.d (dmz1) and e.f.g.h (dmz2) is your DMZs (and set the correct netmask in the access-list) (you could also replace the "any" with more specific net/mask, as well as the "0.0.0.0 0.0.0.0" in the nat-statement).