IP readdressing: good practice

[sghezzi]

Hello,

our internal network runs on private addresses.
We have a range of 4 usable public IP address to be use for NAT of outgoing traffic.
We then have an internal ftp server that needs to be accessible from outside.

I used the following configuration:
- global (outside) 1 a.b.c.155-a.b.c.157 netmask 255.255.255.248
- static (inside,outside) a.b.c.158 10.0.4.30 netmask 255.255.255.255 0 0

Is this the best way to use this range of global addresses?

I have read that a better solution to increase the range would be to use PAT, but how can I use PAT with our situation?
can someone give me a hint?

Thanks a lot
Silvia

 

[tbissett]

Let's break this down into a couple of sections:

1) To use PAT for your outgoing access, do the following:
- Leave your NAT statement as is
- Change your global statement so that all outgoing traffic uses the IP of your PIX outside interface. Here are the commands:
no global (outside) 1 a.b.c.155-a.b.c.157 netmask 255.255.255.248
global (outside) 1 interface
clear xlate (this command will cause a temporary blip in your connections as it clears the existing active NAT translations).

2) For you inbound FTP traffic, you could use port redirection with that same outside interface IP, or dedicate one of your other IPs just for the FTP server (as you do now). My recommendation would be to leave it as it is, just to make the config a little simpler.

If you made the switch on number one, you would some IPs to play with in the future.

 

[sghezzi]

Thank,

actually I was wondering if we can use PAT together with the global command to a smaller range of public IPs.
Like reducing the range of global address to 2 instead of 3 and then using PAT with the 3rd available IP.

Do you think it is possible?

Shall PAT increase PIX performance instead of only using global to a range of IPs?

thanks
Silvia

 

[yizhar]

HI.

> Do you think it is possible?
It is possible, but now wise.

As "tbissett" wrote, it is best to use PAT only, and not the NAT/PAT combination.
This is because the NAT/PAT combination makes administration and management of the pix more difficult.
Because you can not anticipate when and whom will get a NAT address versus the PAT.

Using PAT only will help you reserve few addresses for future use and needs.

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar