Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
Hi, using an ACL with NAT exemption, I'd like to have the following:Traffic from 10.10.10.0 /24 bypass NAT exemption and allowed to be NATdAny other 10.10.0.0 /16 traffic, don't NAT it.My thoughts are this can be done using the following commands:nat...
Hi, could someone assist me in the correct upgrade procedure for a pair of PIX 535s in a failover scenario, without powering them down. The upgrade would be from 6.2 to 6.3.Many thanks in anticipation.Charles
Hi,Please can someone clarify something for me:If I have a general identity NAT statement for a network e.g.static (inside,outside) 172.16.10.0 172.16.10.0 netmask 255.255.255.0Can I use the following static NAT statement with an access-list to NAT o...
Hi,Please can someone clarify something for me:If I have a general identity NAT statement for a network e.g.static (inside,outside) 172.16.10.0 172.16.10.0 netmask 255.255.255.0Can I use the following static NAT statement with an access-list to NAT o...
Hi,Can someone help with what the correct steps are for replacing a primary PIX firewall unit. Here are the steps I followed, but it did not quite go to plan:Replacement of PIX Primary Unit:1. I forced the standby to become active by issuing the "fa...
What if you can't physically get to the boxes to power them down and disconnect cables though, would your suggestion be (once the image has been tftp'd to both boxes) to failover to the secondary. Then reload the primary, then after 10 seconds the s...
Thanks all for your replies. I have got round it by taking out the summarised static for the network, and re-applying the statics missing out the host I want to be able to NAT to the outside interface address.
Hi,Ensure you have the following lines in, before you attempt the global command.ip address outside 192.150.49.1 -> Gives the outside interface an addressnat (inside) 1 0 0 -> This line allows all addresses on the inside, or whatever you want to name...
