nat statements to be changed or not

[ponparthi]

Hi Everybody

We hve 4 zones in pix, viz OUTSIDE, REMOTEZONE, INSIDE.

Iam pasting the config of my pix. I do not want to nat my ips when i communicate from inside to dmz and inside to remotezone, like wise no natting is required when communicating from remotezone to inside and dmz, like wise from dmz to inside. i have used nat 0 statments in combination with nat 1 statements. All my requirment is getting full filled with the exisiting config. But is there any other suggestions to fine tune or alter the config in better way. config is in the attachment

Thanks in advance

Parthiban

[b.hsu]

Please refer the following links for usage of NAT in PIX.

http://www.cisco.com/warp/public/471/pix_router_dyn.pdf

http://www.cisco.com/warp/public/110/39.pdf

[dbellaze]

Instead of using nat 0 you can do static's to the same IP range.

For example let's say you have the following addressing.

DMZ 192.168.1.0/24

Inside 10.0.0.0/24

This static allows the 10.0.0.0 network to remain the same when accessing the DMZ.

static (inside,dmz) 10.0.0.0 10.0.0.0 netmask 255.255.255.0

You could also do it vice versa for the DMZ to the Inside just remember that the extra element of an ACL will have to be applied on the DMZ interface allowing the traffic from the DMZ to the Inside.

Daniel