Global statement./ PAT problem?

[bas95]

Hi,

I use the following Global and NAT statements in my pix config.

global (outside) 1 xxx.xxx.xx.203-xxx.xxx.xx.207 netmask 255.255.255.240
global (outside) 1 xxx.xxx.xx.208
global (intf2) 1 193.172.13.254
nat (inside) 0 access-list 100
nat (inside) 1 172.21.11.0 255.255.255.0 0 0
nat (intf2) 0 access-list 101

All connection from the inside to the outside will be translated bij the global statement. The first 5 connection (203-207) will be one to one mapped. If there are more connection needed, these connection will be all translated using ip adress xxx.xxx.xx.208 and using PAT mapping.

The problem is that the connections using IP xxx.xxx.xx.208 and PAT will not function. I can see that these connection are established using the sh xlate command. If I try to do some FTP or browsing it will not work.

Any advise will be helpfull...

Regards,

Bastiaan van Utrecht
Shimano Europe

 

[baddos]

What is access-list 100 and are the hosts w/ the problem in that ACL?

 

[bas95]

I have found the solution

The problem wad not caused by the access-list... The problem was that the IP address used for Dynamic NAT/PAT translation was the broadcast address for our sub-net.

Regards,


Bastiaan van Utrecht
Shimano Europe