NAT to outside, no NAT to inside (from DMZ)

[peter2002]

Hi

I'm having a WAN-router in my DMZ which connects my subsidaries to the headquarter. What I want is that everyone who is coming over this corporate router has access to the internet (via the PIX outside interface), so the the packets are NATed. On the other hand, if someone from the DMZ (WAN) wants access to the inside network, the packets shoud just be routed (no NAT). How can I configure this? can I configure NAT and no NAT on the same interface (DMZ), depending on the interface the packet is going out?

Thank you very much for your help.
Peter

 

[routerman]

Hi Peter,

This can be set up, you need to use the NAT(0) command with an access list. The list specifies the source and destination IP addresses or subnets, the NAT (0) statement turns off NAT for the addresses specified in the list.

You also need to set up appropriate route statements, but you probably knew that anyway.

 

[themut]

Hey there,

Actually when a higher security level (dmz) goes to a lower security level (outside) you need a tranlation. On your case for the remote end to access the Internet all you need is a nat/global rule. ie:

nat (dmz) 1 <subnet> <mask>
global (outside) 1 interface

When a lower security level (dmz) needs to access a higher security level (inside) you need a static translation for the internal server and an access list. Say for example you have an ftp server on the inside with IP address 10.1.1.1

You need a static translation for this server to the dmz:

static (inside, dmz) 10.1.1.1 10.1.1.1 netmask 255.255.255.255

and you will also need an access list applied to the dmz permitting the ftp traffic to the 10.1.1.1 server.

 

[yizhar]

HI.

As mentioned in previous replies, you can either use static:

static (inside,dmz) ...

Or use nat 0 access-list, but this should be applied to the inside interface, not to the dmz:

nat (inside) 0 access-list ...

If DMZ hosts need access to only few specific hosts on the inside, better use static for those hosts. If you want DMZ hosts to be able to reach all internal hosts, better use nat 0.
In any case, you will need to carefuly configure the access-list on the DMZ interface.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar