Global Command on inside and dmz

[marhoul]

I understand why I use a Global command on the outside interface (to use PAT and therefore keep the ip address of inside machines secret and thus the topology of the net) but why would you use them on the dmz or inside interface?

I noticed when I upgraded to ver 6.2(1) that one of the fixes / additions was to allow global on the inside iterface.

Any ideas?

Thanks,

Mark

 

[yizhar]

HI.

I guess it is to allow NAT/PAT in the reverse direction, for example a branch office or partner net is connected to a 3rd interface on pix, and you want to NAT/PAT in both directions, instead of using nat 0 or nat only from inside.

But this is my guess, I didn't read nor test it.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar