NAT 0 PASSING TRAFFICO FROM DMZ TO OUTSIDE

[spillo3000]

this is my configuration



PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password iuhguiuhjhhh encrypted
passwd oy8guygyogyg encrypted
hostname lab-fw
domain-name labcisco.uk
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no names
access-list dmz-in permit icmp any any
access-list dmz-in permit tcp any any
access-list dmz-in permit udp any any
access-list dmz-in permit ip any any
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq 3389
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq 139
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq telnet
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq 445
access-list inside-in permit udp host a.b.c.z a.b.d.0 255.255.255.0 eq netbios-ns
access-list inside-in permit udp host a.b.c.z a.b.d.0 255.255.255.0 eq netbios-dgm
access-list inside-in deny tcp any a.b.d.0 255.255.255.0
access-list inside-in deny udp any a.b.d.0 255.255.255.0
access-list inside-in permit tcp any any
access-list inside-in permit udp any any
access-list inside-in permit icmp any any
pager lines 24
logging on
logging trap debugging
logging host dmz a.b.d.x
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside a.b.y.10 255.255.255.252
ip address inside a.b.c.1 255.255.255.0
ip address dmz a.b.d.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address dmz 0.0.0.0
pdm history enable
arp timeout 14400
nat (inside) 0 a.b.c.0 255.255.255.0 0 0
static (inside,dmz) a.b.c.0 a.b.c.0 netmask 255.255.255.0 0 0
access-group inside-in in interface inside
access-group dmz-in in interface dmz
conduit permit icmp any any
conduit permit tcp a.b.c.0 255.255.255.0 range 0 65535 a.b.y.f 255.255.255.252
conduit permit udp a.b.c.0 255.255.255.0 range 0 65535 a.b.y.f 255.255.255.252
conduit permit tcp a.b.d.0 255.255.255.0 range 0 65535 a.b.y.f 255.255.255.252
conduit permit udp a.b.d.0 255.255.255.0 range 0 65535 a.b.y.f 255.255.255.252
route outside 0.0.0.0 0.0.0.0 a.b.y.g 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 60
ssh timeout 5
terminal width 80
Cryptochecksum:dfgdgdgdgdwgewgewgefgregfeg#



how can i passing traffic from dmz interface to outside interface with nat 0?

 

[NetworkGhost]

Are you using public IP addresses on your DMZ interface?

 

[spillo3000]

this isn't a dmz but a protect subnet, i must bypass nat.....

 

[spillo3000]

* i remove the conduit command .
* i add nat(dmz)0 a.b.d.0 a.b.d.0 netmask 255.255.255.0 .

what can i do ?......

 

[lgarner]

You don't want nat(0), you want static NAT.

access-list dmz_in permit ip any any
access-group dmz_in in interface dmz
static (dmz,outside) a.b.d.0 a.b.d.0 netmask 255.255.255.0

Also, ensure that your border router has a route to a.b.d.0 via a.b.y.10.

 

[lgarner]

To clarify your nat statement:

access-list dmz-in permit ip any any
access-group dmz-in in interface dmz
nat (dmz) 0 a.b.d.0 255.255.255.0 0 0

That should do it to perimt all outbound traffic using the actual source IP addresses.