Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

NONAT on a PIX 515E 6.3, are my commands right?

Status
Not open for further replies.

jdrama

IS-IT--Management
Jan 29, 2008
3
US
We currently run a PIX 515E with 6.3 software, I want one of our global address's, 12.x.x.x, to not use nat. I wanted to confirm that my config seems correct.

internal server on DMZ interface should have 12.x.x.x, 255.255.255.0, default set to the static outside route on the the pix, 12.x.x.144, these values should be assigned to it's wan nic which is plugged directly into the
PIX DMZ interface port.

The config for this interface are as follows:

nameif ethernet2 DMZ security50

access-list acl-in permit tcp any host 12.x.x.x eq www
access-list acl-in permit udp any eq isakmp host 12.x.x.x eq isakmp log
access-list acl-in permit udp any eq 4500 host 12.x.x.x eq 4500
access-list acl-in permit udp any eq 1701 host 12.x.x.x eq 1701
access-list acl-in permit tcp any host 12.x.x.x eq pptp
access-list acl-in permit gre any host 12.x.x.x log 7
access-list DMZ permit icmp any any
access-list DMZ permit ip any any

static (DMZ,outside) 12.x.x.x 192.x.x.6 netmask 255.255.255.255 0 0

access-group acl-in in interface outside

Are the following commands correct:
clear command before each of the above commands except nameif and access group command
afterwards issue the following commands

access-list no-nat permit ip 12.x.x.x 255.255.255.255 0 0
nat (DMZ) 0 access-list no-nat

I would assume that a static route is unneeded since the access
list already associates the external ip 12.x.x.x with the dmz interface

I assume I then need to recreate the above access lists in the form

access-list acl-in permit tcp any host 12.x.x.x eq www

Thanks in advance

 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top