|
|
Question : Problem: PIX: Static statement required for no NAT?
|
|
I have traditionally done two things to make the pix work without nat. One is to set up a NAT 0 process. And secondly I have put in a static statement to say that the addresses inside should be represented as themselves outside. For example...
nat (inside) 0 10.0.0.0 255.0.0.0 0 0
and...
static (inside,dmz) 10.0.0.0 10.0.0.0 netmask 255.255.0.0 0 0
...this to define packets leaving inside for the dmz to retain their 10.* address as they egress the dmz port. This combination seemed to solve a problem I had once with trying to have the packets reach the DMZ from inside. But lately I found a fly in the ointment with this (has to do with multi-tiered pixen and non-natting - a long story for another day.) My question is - is my static statement necessary? Should the fact that I have a nat (inside) 0 process obviate the need to have such a static?
|
Answer : Problem: PIX: Static statement required for no NAT?
|
|
Dear mmedwid: here is a link that may help clarify your question, http://www.cisco.com/warp/public/707/28.html I believe that you would need to keep both statements because as Irmoore points out, if you wish traffic to flow from both lower security level to higher and visa versa. This is complicated by the fact that you are using the same IP subnet within your DMZ and your Inside network (which isn't the usual case), you would still need to define the static command as you have it, otherwise depending upon how and where you apply your ACL's you may have difficulties with traffic flowing both ways. Hope this helps, Chriskohn
|
|
|
|