Access-Lists with NAT

[dukenukem]

Hi All,

Quick question for you (actually 2)

I have a 800 Router with 2 Ethernets 0 and 1.

0 is my LAN and 1 is connected to ADSL.

I use NAT. If int E1 obtains private IP from ADSL modem, then if i want to allow certain traffic to Local IP 10.0.0.2 and i wanted the ACL to be on E1, would this be ok ???

ACL

ip access-list extended 101

permit ip any host 10.0.0.2

E1

ip access-group 101 in

I mean should i specify the Private IP 10.0.0.2 or should i specify the IP That i am using for NAT (also how can i specify this is this automatic DHCP address keeps changing ???)

Second question

----------------

Also if i used public IP on my ADSL interface E1 that i am also using as NAT (overloading), how would the ACLs look like ???

I am not sure if i explained myself correctly.

Hope you can help .

George

[Nicholas Vigil]

Regarding the the acl, you would specify the NAT IP as that is the address that traffic will see from the outside.

If your public IP is 1.2.3.4 then the acl would be:

ip access-list extended 101

permit ip any host 1.2.3.4

Then the pix would accept the traffic and translate the 1.2.3.4 to 10.0.0.2 and forward it correctly assuming you have the proper NAT setup.

As for your second questions I am not sure if what you are trying to do will work unless you have a static IP. Without the static IP you will be modifying your acl everytime your IP changes.

[dukenukem]

Ok , i understand that i will have to use the public IP in my ACL on the ADSL connected interace.

If i obtain a private IP on my ADSL interface from the ISP, then is it the best method to aply the ACL on the LAN interface and assign it as IP ACCESS-GROUP xxx OUT ????

And one more question.

I understand the concept with ACL with one public IP that will be NAT (overloaded). What if i am using multiple public IPs that i will NAT on all of them ???

how does this affect my ACLs. Is there a way around this ????

Thanks,

George

[balajitvk]

Hi George,

The first solution is seems to good...... It is better to apply to the outgoing traffic on LAN instead of applying to the public interface... where the ip is going to change everytime u connect.....

Yes for the second case also u better apply it on LAN interface..... Only some unnecessary processing will happen, but that will worth while u opt for dhcp....

Rate if it does,

Balaji.