PIX 515E-UR interface4 without nat allowed (routed)?

[PcClone]

Hello, thank you in advance for any help that can be provided.

We are running ver. 8 of the pix software.

Can we have a public ip behind the pix on an interface when the other interfaces are doing nat? I know about transparent mode, but that seems an all or nothing solution.

We are installing a system that needs the server to have a public ip in it's interface settings for licensing reasons. I could place the machine outside the PIX I'd rather not rely on a software firewall (iptables) on the host.

We currently have a /29 from our ISP and are using the 4 IPs allowed (they use the others for routing/router). We can go to a /28 if needed so we could route to that interface.

We have 5 total interfaces with 3 in use. This system could be left on a dedicated interface if needed,but we would prefer to be able to put another public ip assigned server on that interface in the future.

We can't use NAT or aliases for this machine and I have never attempted something like this. Most of my google and forum searches have ended with incomplete solutions or no answers.

Thanks for any help you can provide!

 

[unclerico]

It's really early in the morning so all of my neurons aren't firing yet, but I think NAT Exemption should work:

PIX(config)# access-list extended NONAT permit ip 200.100.50.7 255.255.255.248 any
PIX(config)# nat (dmz) 0 access-list NONAT

Replace 200.100.50.7 with the public IP assigned to the server. This is also assuming that the server is placed in your DMZ so you will need to adjust this if your server is on the inside or if your interface name is different.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[PcClone]

Thanks for the quick reply. A few questions. Since you used a .248 subnet for the nonat does that mean I need to change the subnet on the outside interface to not overlap the DMZ subnet? Also, I assume that since you used a subnet in that nonat staement I can put a few computers on that dmz interface and just assign ips in that subnet, am I correct?
Or am I reading this wrong and the .248 is because I currently have a .248 and the nonat statement subnet should match the subnet on the outside interface?

Thanks again.

 

[unclerico]

Try it both ways; one with the /29 prefix and one with a /32 prefix. Either one should work.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)