Security

Ask something
Discussion Locked

Cisco Pix Config-NAT

0 helpful
3 replies

by madroxxx

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a cisco pix515 with a DMZ card in it. I have six public addresses X.X.X.180-185 I need to nat all my network from private 10.10.10.x addresses as well as route one public address to a webserver in the DMZ.

I have assigned the external cardx.x.x.180
I have assigned the internal card 10.10.10.1
I have assigned the DMZ card 192.168.1.1

I have NAT from x.x.x.181 to 10.10.10.x
I have NAT from X.X.X.185 to 192.168.1.2(webservers private address).

Am I going about this in the correct manner?

3 replies

by hmoerkholt

If you have been using the right commands then yes!

But just to clarify it here is how i would configure it:

To establish a NAT/PAT pool for outgoing traffic from Your inside network

nat (inside) 1 10.1.1.0 255.255.255.0

global (outside) 1 x.x.x.181

To assign an address to Your webserver on the outside

static (dmz,outside) X.X.X.185 192.168.1.2 netmask 255.255.255.255 ( maps local address to global address)

The 2 following commands do the same thing but in different ways

access-list fromoutside permit tcp any host X.X.X.185 eq www ( this is if you use a newer software version)

conduit permit tcp host X.X.X.185 eq www any ( same as above but wit older software version)

Hope this can help You !

by hmoerkholt

Sorry i forgot something.

When You use the access-list command You also have to issue the following command.

access-group fromoutside in interface outside

sorry

by wlbowers

You know that you can contact Cisco and they will help you lock this unit down.

Good Luck Lee

This discussion is closed to new replies.