PIX506E external interface addressing

[xdeq]

I think this is simple question since many of you have this configured already.

what should be addressing on my external interface,
on segment between PIX506E and ISP DSL router?

I have 5 public ips from the ISP.
internal interface is 192.168.1.1
can I use addresses 172.16.1.1(PIX) 172.16.1.2(Router)?
or I have to use public addresses?

1. I'd like to use one IP for NAT/PAT
and use the rest(4) for static mapping to internal hosts
2. What ip address must specify VPN clients in such case?
Can they use the one used for NAT/PAT ?

Thanks
Robert

 

[308win]

Public address on the PIX, Nat off on the DSL router. You might need another block of IP addresses from your ISP. It sounds like your block is assigned to the DSL router. The external side of the DSL router will have an IP Address with a 255.255.255.252 mask. Your PIX and the network between the PIX and the DSL router will have a 255.255.255.248 mask. (If your ISP uses PPPOE it might be a different story.) The VPN will access via the same address on the PIX interface, that you are also using for PAT. The other addresses are available for static address maping with NAT.